Rust CLI: honor NO_PROXY=* like the Node CLI - #334
Merged
Conversation
A local proxy differential (both CLIs against a recording forward proxy across nine HTTP_PROXY/NO_PROXY combinations) showed reqwest ignores the conventional NO_PROXY=* bypass-everything wildcard that undici and curl honor: with HTTP(S)_PROXY set and NO_PROXY=*, the Rust CLI kept routing through the proxy while the Node CLI went direct. In environments that use NO_PROXY=* to disable a configured proxy, the Rust CLI would silently send traffic through it. Detect a `*` entry in NO_PROXY/no_proxy and disable proxying on all three reqwest client builders (client.rs, payloads.rs which is compiled standalone by the include-style tests, and root_startup.rs). Every other combination already matched: exact IP and hostname bypass, port-qualified entries, lowercase vars, unset vars. Known remaining difference, deliberately kept: reqwest honors CIDR entries (NO_PROXY=127.0.0.0/8) which undici ignores; matching Node would make the Rust CLI strictly less correct. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Confidence Score: 5/5This looks safe to merge.
|
| Filename | Overview |
|---|---|
| cli-rust/src/config.rs | Adds the shared proxy wildcard helper and exact * parsing. |
| cli-rust/src/client.rs | Applies the shared wildcard check to the main reqwest client builder. |
| cli-rust/src/payloads.rs | Applies the shared wildcard check to payload HTTP requests. |
| cli-rust/src/root_startup.rs | Applies the shared wildcard check to the startup root-account request. |
| cli-rust/tests/config.rs | Adds unit coverage for conventional wildcard parsing forms. |
| cli-rust/tests/payloads.rs | Updates the include-style payload test shim with the new proxy helper. |
Reviews (4): Last reviewed commit: "Merge updated rust-cli-port base" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Greptile: checking both spellings with any() meant no_proxy=127.0.0.1 alongside an inherited NO_PROXY=* disabled proxying based on a value reqwest would never use. The gate now resolves the effective value exactly like reqwest's NoProxy::from_env (NO_PROXY first, falling back to no_proxy) so it always agrees with the list reqwest applies. The helper moves to config.rs as the single canonical copy; client.rs re-exports it and payloads.rs (compiled standalone by the include-style tests, whose config stub now carries a passthrough) calls it directly instead of duplicating the parse. Verified against the recording proxy: NO_PROXY=* bypasses; NO_PROXY=* + no_proxy=example.com bypasses (upper wins); NO_PROXY=example.com + no_proxy=* still proxies (upper wins, matching reqwest). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Greptile round 2, resolved empirically: undici gives the lowercase no_proxy precedence when both spellings are set (verified by running the Node CLI through a recording proxy), the opposite of reqwest. With the gate now lowercase-first, all four wildcard scenarios match Node: NO_PROXY=* alone and no_proxy=* alone both bypass; NO_PROXY=* + no_proxy=host keeps proxying (the gate defers to the lowercase list and reqwest ignores the * entry in the uppercase list it resolves); NO_PROXY=host + no_proxy=* bypasses. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
etbyrd
force-pushed
the
rust-cli-port
branch
2 times, most recently
from
July 21, 2026 17:25
322c5b5 to
0765fa5
Compare
# Conflicts: # .github/workflows/rust-cli-release.yml # .github/workflows/sdk-checks.yml # Makefile # cli-rust/src/client.rs # cli-rust/src/completion_commands.rs # cli-rust/src/config.rs # cli-rust/src/friendly.rs # cli-rust/src/functions_commands.rs # cli-rust/src/help_snapshots.generated.rs # cli-rust/src/payloads.rs # cli-rust/src/payments.rs # cli-rust/src/root_startup.rs # cli-rust/tests/completion_commands.rs # cli-rust/tests/config.rs # cli-rust/tests/payloads.rs # scripts/generate-rust-cli-help-snapshots.mjs # scripts/run-cli-help-sweep.mjs # scripts/run-cli-parity.mjs # test-fixtures/cli-parity/cases.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Parity backlog: a proxy differential (both CLIs through a recording forward proxy, nine
HTTP_PROXY/NO_PROXYcombinations) found that reqwest ignores the conventionalNO_PROXY=*bypass-everything wildcard that undici and curl honor. With a proxy configured andNO_PROXY=*, the Rust CLI silently kept routing traffic through the proxy while the Node CLI went direct.What changed
client.rs:env_no_proxy_wildcard()detects a*entry inNO_PROXY/no_proxy(comma-separated, trimmed;*.example.comdoes NOT count) and the builder calls.no_proxy()when present. Unit tests cover the parse.payloads.rs(compiled standalone by the include-style tests, so it carries a small local copy) androot_startup.rs.Differential results after the fix
NO_PROXY=127.0.0.1NO_PROXY=localhost(target by IP)NO_PROXY=127.0.0.0/8NO_PROXY=*NO_PROXY=example.comNO_PROXY=127.0.0.1:1Deliberately kept difference: reqwest honors CIDR entries which undici ignores; matching Node there would make the Rust CLI strictly less correct for users behind CIDR-scoped corp proxies.
Validation
make rust-cli-checkgreen; proxy matrix above re-run against the built binary.🤖 Generated with Claude Code