fix(proxy): strip unsupported IPv6 CIDRs from NO_PROXY

[pi-dal]

Fixes #1959

Summary

• strip unsupported IPv6 CIDR entries from NO_PROXY / no_proxy before httpx client initialization
• preserve valid non-CIDR entries such as localhost, 127.0.0.1, and ::1
• add a regression test that reproduces the proxy + IPv6 CIDR startup crash path

Verification

• uv run pytest tests/utils/test_proxy.py
• uv run ruff check src/kimi_cli/utils/proxy.py tests/utils/test_proxy.py
• reproduced the original environment shape with HTTP_PROXY=http://127.0.0.1:7890 and NO_PROXY=localhost,127.0.0.1,::1,fd00::/8,fe80::/10; httpx.Client() now initializes successfully after normalization
• make test

Full Check Notes

• make ai-test currently fails on the existing tests_ai/scripts/main.yaml reference to kimi_cli.tools.multiagent:Task, which is unrelated to this change
• make check still reports existing non-blocking ty diagnostics and fails on pre-existing web Biome lint errors in web/src/features/chat/components/approval-dialog.tsx and web/src/features/chat/components/session-files-panel.tsx

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[Copilot]

Pull request overview

Fixes a startup crash in environments where NO_PROXY includes IPv6 CIDR blocks by normalizing NO_PROXY/no_proxy before httpx client initialization.

Changes:

• Add normalization to strip IPv6 CIDR entries from NO_PROXY / no_proxy while keeping non-CIDR entries intact.
• Add a regression test that reproduces the httpx.Client() initialization failure scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/kimi_cli/utils/proxy.py	Filters unsupported IPv6 CIDR entries from NO_PROXY/no_proxy during proxy env normalization.
tests/utils/test_proxy.py	Adds a regression test to ensure httpx.Client() initialization doesn’t crash with IPv6 CIDRs in NO_PROXY.

Comments suppressed due to low confidence (1)

src/kimi_cli/utils/proxy.py:41

• The normalize_proxy_env() docstring still only documents the socks:// -> socks5:// rewrite, but the function now also mutates NO_PROXY/no_proxy by stripping unsupported IPv6 CIDR entries. Please update the docstring to describe this additional normalization (and the rationale) so callers understand the side effects.

def normalize_proxy_env() -> None:
    """Rewrite ``socks://`` to ``socks5://`` in proxy environment variables.

    Many proxy tools (V2RayN, Clash, etc.) set ``ALL_PROXY=socks://...``, but
    httpx and aiohttp only recognise ``socks5://``.  Since ``socks://`` is
    effectively an alias for ``socks5://``, this function performs a safe
    in-place replacement so that downstream HTTP clients work correctly.
    """

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This regression test currently only asserts that httpx.Client() construction succeeds, which makes it less direct about what normalize_proxy_env() is expected to do. Consider also asserting that NO_PROXY is rewritten to remove the IPv6 CIDRs while preserving localhost,127.0.0.1,::1 so the test continues to validate the normalization even if httpx behavior changes in the future.

Suggested change

	assert os.environ["NO_PROXY"] == "localhost,127.0.0.1,::1"

[Copilot]

Prefer using with httpx.Client() as client: (or contextlib.closing) instead of manual client = ...; client.close() so the client is always closed even if an assertion is added later and fails mid-test.

Suggested change

	client = httpx.Client()
	client.close()
	with httpx.Client() as client:
	pass