Bug: [::1] in child NO_PROXY breaks Python/httpx before any request

[wsqstar]

Bug: [::1] in child NO_PROXY breaks Python/httpx before any request

DSH correctly protects its own loopback traffic by adding localhost, 127.0.0.1, ::1, and [::1] to the resolved proxy bypass list. The bracketed variant is needed for the current Undici behavior.

The problem is that this same resolved value is exported to every spawned child process. Python httpx does not accept [::1] as a NO_PROXY entry: when trust_env=True builds its proxy configuration, it interprets the value as a malformed host/port pattern and raises:

httpx.InvalidURL: Invalid port: ':1]'

This occurs during httpx.Client() construction, before DNS resolution or any network request. It can therefore make unrelated local features fail, including model warmup through huggingface_hub.

Minimal reproduction:

NO_PROXY='localhost,127.0.0.1,[::1]' \
HTTP_PROXY='http://127.0.0.1:7897' \
python -c 'import httpx; httpx.Client()'

Expected: the client initializes normally.

Actual: Invalid port: ':1]'.

The local workaround is to remove bracketed IPv6 entries for this Python application's child environment. ::1 remains semantically equivalent for Python/httpx:

NO_PROXY='localhost,127.0.0.1,::1' \
HTTP_PROXY='http://127.0.0.1:7897' \
python -c 'import httpx; httpx.Client()'

Suggested DSH fix:

1. Keep [::1] in the DSH-internal/Undici policy if required.
2. Export a portable child-process NO_PROXY variant that omits bracketed IPv6 literals, while retaining ::1.
3. Add a regression test for proxyEnvironmentForChild() ensuring generic child environments do not contain [::1].

This is a cross-runtime compatibility issue in child environment propagation, not a proxy reachability or TUN-routing failure.

[xop01]

The repro is a real httpx bug. With trust_env=True, httpx reads NO_PROXY and treats [::1] as a URL. The ] makes it parse :1] as a port, so httpx.Client() dies before any request. Bare ::1 is the form it accepts. This is the same failure as encode/httpx#3221.

Keep [::1] only for the runtime that needs the brackets. For Python children, export localhost,127.0.0.1,::1 and leave the brackets out. A client that should ignore proxy variables entirely can use httpx.Client(trust_env=False).

@wsqstar