fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars (#35) by XXPermanentXX · Pull Request #51 · modelstudioai/cli

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX · 2026-06-12T06:54:25Z

Summary

Fixes#35 — running bl behind a VPN / corporate proxy failed with ECONNRESET: Client network socket disconnected before secure TLS connection was established.

Root cause: Node's built-in fetch (undici) does not read proxy environment variables, so the CLI always connected directly, bypassing the local proxy and getting blocked.

Fix: at startup, install an EnvHttpProxyAgent as the global undici dispatcher — but only when HTTP_PROXY / HTTPS_PROXY is actually set. When no proxy variable is configured, the global dispatcher is untouched and behavior is exactly as before.

export HTTPS_PROXY=http://127.0.0.1:7890
bl app list # now routes through the proxy

Changes

packages/cli/src/proxy.ts (new): readProxyEnv() + setupProxyFromEnv(). Lowercase variables take precedence over uppercase (curl convention); NO_PROXY is supported.
- Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one.
- An invalid proxy URL fails with a clear Invalid proxy configuration: … error (plus hint) instead of a raw stack trace.
packages/cli/src/main.ts: call setupProxyFromEnv() at module top level, before any fetch is issued (including update-checker / telemetry).
packages/cli/src/error-handler.ts: the ECONNRESET hint now suggests export HTTPS_PROXY=… for VPN / corporate-proxy users.
undici added as an explicit dependency (catalog ^8.4.1).

Tests (fully offline, no credentials required)

tests/proxy.test.ts: readProxyEnv parsing — unset/blank handling, lowercase precedence, empty-string-masking regression, NO_PROXY.
tests/e2e/proxy.e2e.test.ts: runs a minimal probe script (setupProxyFromEnv() + a bare fetch()) against a .invalid host through a local CONNECT proxy. It does not drive any CLI command, so it needs no api key / access token — consistent with the existing e2e design. Verifies:
- with HTTPS_PROXY set, the bare fetch tunnels through the proxy (CONNECT to the target host);
- empty lowercase https_proxy does not mask HTTPS_PROXY;
- NO_PROXY match keeps the request direct;
- with no proxy vars set, the proxy receives zero traffic (no behavior change);
- an invalid proxy URL produces a clear error message.

All proxy tests pass under a simulated CI environment (empty HOME, no credentials).

Note

Supersedes #50, which had a tangled commit history. This branch is rebuilt cleanly on top of main. The version bump / CHANGELOG for the release are intentionally left out and will go in a separate PR.

Also includes two small unrelated cleanups as separate commits: a video-ref r2v e2e prompt tweak, and removing the machine-local .claude/scheduled_tasks.lock from version control.

Node's built-in fetch (undici) ignores proxy environment variables, so bl always connected directly and failed with ECONNRESET behind a VPN or corporate proxy. Install an EnvHttpProxyAgent as the global dispatcher at startup, but only when a proxy variable is actually set — behavior is unchanged otherwise. Lowercase variables take precedence over uppercase (curl convention) and NO_PROXY is honored. Values are trimmed and passed explicitly to work around undici reading env vars with ??, where an empty lowercase variable (https_proxy="") masks a configured uppercase one. Invalid proxy URLs fail with a clear usage error instead of a stack trace, and the ECONNRESET hint now suggests exporting HTTPS_PROXY. Tests are fully offline and need no credentials: unit tests cover env parsing, and the e2e test runs a minimal probe (setupProxyFromEnv + a bare fetch) against a .invalid host through a local CONNECT proxy to verify traffic routes through the proxy, NO_PROXY is honored, no dispatcher is installed when unset, and invalid values error clearly.

Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

XXPermanentXX added 3 commits June 12, 2026 14:53

test: use leaf image prompt in video-ref r2v e2e
d5fb2bf
Switch the seed-image prompt from a cat sketch to a green leaf for a simpler, more reliably-generated reference frame.

chore: stop tracking .claude/scheduled_tasks.lock
cc63e1e
It's a machine-local runtime lock file that shouldn't be in the repo; remove it and add it to .gitignore.

XXPermanentXX mentioned this pull request Jun 12, 2026
fix: honor HTTP_PROXY / HTTPS_PROXY / NO_PROXY env vars #50
Closed

XXPermanentXX added 2 commits June 12, 2026 16:07

Merge remote-tracking branch 'origin/main' into fix/proxy-env-support-v2
ada7ed3

chore: release 1.3.1
d36bc5a
Bump bailian-cli / bailian-cli-core to 1.3.1, sync skill version, and document the HTTP_PROXY / HTTPS_PROXY / NO_PROXY fix (#35) in CHANGELOG.

XXPermanentXX merged commit a90a35d into mainJun 12, 2026
1 check passed

XXPermanentXX deleted the fix/proxy-env-support-v2 branch June 12, 2026 09:16

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline, no credentials required)

Note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline, no credentials required)

Note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline, no credentials required)

Note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline, no credentials required)

Note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

XXPermanentXX commented Jun 12, 2026

Summary

Changes

Tests (fully offline, no credentials required)

Note

Uh oh!

Uh oh!

Reviewers

Assignees

Labels