Repository navigation
fix(runtime): reject non-origin proxy URLs - #386
Merged
Merged
Conversation
what changed: Require a root pathname, no search and no fragment in usableProxyUrl; extend proxy and doctor regressions, including a loopback-only fetch that must still go direct. why: Undici parseOrigin refuses those URL shapes, so auto-enabling them crashes Node fetch and doctor incorrectly reports success. Restore the existing invalid-proxy path (ADR-0047); no alternative design was set aside. what it touched: runtime.mjs, proxy.test.mjs, doctor.test.mjs, runtime/doctor architecture rows and CHANGELOG.md. No new interface or domain term. what you verified: verified - red-first runtime assertion and doctor regression. Targeted proxy/runtime/doctor checks and the required full suite run before commit acceptance. what you got wrong and fixed: mistake - running six full suites concurrently exceeded the default 3900-second budget; where - local commit validation on this Windows host; impact - affected hooks refused commits before publication; cause - excess concurrent subprocess and filesystem work; fix - retry one commit at a time with the ADR-0142 timeout extension (RESEARCH_KIT_GATE_TIMEOUT=7920); verified - the required full-suite commit gate accepted the commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proxy URLs with paths, queries or fragments passed the usability check, so enabling Node environment proxies crashed in Undici and doctor incorrectly reported success. Match Undici's origin rule: a root pathname and no search/hash. Invalid values follow the existing direct-request fallback and named warning; a root trailing slash remains valid.
Fixes #380
what changed: Tightened usableProxyUrl and expanded the existing malformed-proxy, doctor and loopback-fetch regressions.
why: Restore ADR-0047's existing invalid-proxy behavior. The upstream Undici origin parser rejects these URL shapes. No alternative design was set aside.
what it touched:
lib/runtime.mjs, proxy/doctor tests, runtime/doctor architecture rows and changelog. No new interface or domain term; the test inventory is unchanged.what you verified: verified - red-first baseline (91 passed, three expected failures), then passing proxy/runtime regressions and direct assertions for all three URL shapes. The required full suite was accepted by the repository commit gate.
what you got wrong and fixed: mistake - running six full suites concurrently exceeded the default 3900-second budget; where - local commit validation on this Windows host; impact - affected hooks refused commits before publication; cause - excess concurrent subprocess and filesystem work; fix - retry one commit at a time with the ADR-0142 timeout extension (RESEARCH_KIT_GATE_TIMEOUT=7920); verified - the required full-suite commit gate accepted the commit.
Full-suite detail: verified - 1777 passed, 0 failed, 12 unsupported capabilities on win32/Node 24.20.0 in 1581.4 seconds. The gate's documented local unsupported-capability opt-in was used; CI exercises its supported platforms separately.