-
-
Notifications
You must be signed in to change notification settings - Fork 80.7k
web_fetch: auto-enable useTrustedEnvProxy when HTTP_PROXY is detected #95560
Copy link
Copy link
Closed
Copy link
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:otherThis issue has meaningful maintainer-visible impact outside the owned taxonomy.This issue has meaningful maintainer-visible impact outside the owned taxonomy.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Description
Metadata
Metadata
Assignees
Labels
P2Normal backlog priority with limited blast radius.Normal backlog priority with limited blast radius.clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.clawsweeper:needs-maintainer-reviewClawSweeper marked this issue as needing maintainer review before automation.ClawSweeper marked this issue as needing maintainer review before automation.clawsweeper:needs-product-decisionClawSweeper marked this issue as needing a product or behavior decision.ClawSweeper marked this issue as needing a product or behavior decision.clawsweeper:needs-security-reviewClawSweeper marked this issue as needing security-sensitive review.ClawSweeper marked this issue as needing security-sensitive review.clawsweeper:no-new-fix-prClawSweeper does not recommend queueing a new automated fix PR for this issue.ClawSweeper does not recommend queueing a new automated fix PR for this issue.clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.impact:otherThis issue has meaningful maintainer-visible impact outside the owned taxonomy.This issue has meaningful maintainer-visible impact outside the owned taxonomy.impact:securitySecurity boundary, credential, authz, sandbox, or sensitive-data risk.Security boundary, credential, authz, sandbox, or sensitive-data risk.issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.
Type
Fields
Priority
None yet
Problem
tools.web.fetch.useTrustedEnvProxy(introduced in 2026.6.6) successfully routesweb_fetchthrough the system proxy when enabled. However, users must manually discover and enable this setting — there is no feedback loop telling them it exists.When a Gateway process has
HTTP_PROXY/HTTPS_PROXYenvironment variables set butuseTrustedEnvProxyis not configured,web_fetchsilently uses direct connections. This leads to confusing timeout failures on networks where direct access is blocked (e.g., behind GFW, corporate firewall).Current Behavior
HTTP_PROXY/HTTPS_PROXYin shell/envexec+curlworks fine (curl respects env proxy vars)web_searchmay work (some providers are directly accessible)web_fetchsilently fails with timeout → user has no clue whyThe user only discovers
useTrustedEnvProxyby:Proposed Solution
When
HTTP_PROXYorHTTPS_PROXYis present in the Gateway process environment:useTrustedEnvProxytotrue(or at minimum)Option (2) is lower risk and avoids the NO_PROXY gap (#93807) affecting users who do NOT want proxy routing.
Related Issues
useTrustedEnvProxy)useTrustedEnvProxyignoresNO_PROXY(security concern)Environment
HTTP_PROXY=http://127.0.0.1:7897