Skip to content

fix(cdp): remote attach takes its proxy from the caller at session open - #137

Merged
broven merged 1 commit into
mainfrom
fix/136-attach-proxy-from-caller
Oct 8, 2026
Merged

broven merged 1 commit into
mainfrom
fix/136-attach-proxy-from-caller

Conversation

@broven

@broven broven commented Oct 8, 2026

Copy link
Copy Markdown
Owner

概述

  • A remote --attach (session new, markdown/search --attach) now takes its proxy from the CLI caller's environment, resolved once when the session opens and pinned on it (workspace["proxy"]). Only env vars are read, never the macOS system proxy. NO_PROXY supports CIDR and domain suffixes. Loopback targets, including *.localhost and 0.0.0.0, are always direct.
  • All three connections to the remote browser use exactly that value: CDP discovery (httpx, trust_env=False), the session's CDP websocket, and the Playwright facade bridge. The daemon's own proxy env is never read. Before this, a SOCKS all_proxy in the daemon's env crashed discovery (socksio missing) even with the host in NO_PROXY, so the same command behaved differently depending on which daemon was running.
  • httpx[socks] and python-socks are now default dependencies. Proxy credentials are redacted in session list --json and in logs. A connect failure through a proxy names the proxy and the NO_PROXY=<host> bypass. ADR-0016 records the decision and supersedes env backend: support agent sessions (session new --backend=env) + fix facade proxy for an external CDP ws (attach to CloakBrowser profiles) #20's "never proxy the control channel".

Closes #136

测试证明

New E2E: tests/daemon/e2e/test_issue136_attach_proxy.py. It uses a real Chrome reached through a non-loopback forwarder, recording HTTP and SOCKS5 proxies, and a daemon whose own env points at a dead proxy. It covers five scenarios: HTTP proxy (discovery GET + 2 CONNECTs, credentials redacted), SOCKS5 all_proxy, NO_PROXY CIDR → direct, no caller proxy → direct, and dead caller proxy → actionable error. It fails on main with the #136 error and passes on this branch. The artifact is tests/daemon/e2e/_artifacts/issue136-proxy-routes.json.

The cdp-relevant real-Chrome E2E subset also passed: test_issue136_attach_proxy, test_l1_playwright_facade, test_search_command_cdp, test_l2_heredoc_playwright_page, test_l2_multisession, test_l1_roundtrip, test_l3_parity → 24 passed in 233.30s. mise run lint passes. The full ~23 min E2E suite was not run.

mise run test
[test:skill] ........................................................................ [ 85%]
[test:daemon] ........................................................................ [ 26%]
[test:daemon] ........................................................................ [ 33%]
[test:skill] ..................................................                       [100%]
[test:skill] 338 passed in 6.15s
[test:skill] Finished in 6.90s
[test:daemon] ........................................................................ [ 39%]
[test:daemon] ........................................................................ [ 46%]
[test:daemon] ...............................sssssss.................................. [ 53%]
[test:daemon] ........................................................................ [ 59%]
[test:daemon] ........................................................................ [ 66%]
[test:daemon] ........................................................................ [ 73%]
[test:daemon] ........................................................................ [ 79%]
[test:daemon] ........................................................................ [ 86%]
[test:daemon] ........................................................................ [ 92%]
[test:daemon] ........................................................................ [ 99%]
[test:daemon] ....                                                                     [100%]
[test:daemon] 981 passed, 103 skipped in 42.09s
[test:daemon] Finished in 42.91s
Finished in 42.93s

界面证据

N/A:无界面改动

检查项

  • 「测试证明」已贴实际命令与输出
  • 「界面证据」已填截图或视频,或已写明 N/A

🤖 Generated with Claude Code

…ession open

`session new --attach=<url>` (and markdown/search --attach) now resolve the
proxy for the attach URL from the CLI's own environment (env vars only,
NO_PROXY with CIDR/suffix support, loopback always direct) and pin it on the
session. CDP discovery, the session's CDP websocket and the facade bridge all
use exactly that value; the daemon's own proxy env is never read. A SOCKS
all_proxy in the daemon's env used to crash discovery even with the host in
NO_PROXY.

- httpx[socks] + python-socks become default dependencies
- *.localhost and 0.0.0.0 count as loopback
- proxy credentials are redacted in session list / logs
- connect failures through a proxy name it and the NO_PROXY bypass
- ADR-0016 records the decision (supersedes #20's "never proxy")

Closes #136

Co-Authored-By: Claude <noreply@anthropic.com>
@broven
broven merged commit 345521d into main Oct 8, 2026
1 check passed
@broven
broven deleted the fix/136-attach-proxy-from-caller branch October 8, 2026 11:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

cdp --attach to a remote endpoint fails under SOCKS all_proxy even when the host is in NO_PROXY

1 participant