fix(cli): 代理回环直连、无法解析时不中断、空大写变量回退（0.9.2）

[HarlonWang]

处理 #30 合入后才看到的 Sourcery 审查（三条都有效，0.9.1 已发出，本 PR 发 0.9.2）：

#	问题	修法	测试
1	设了代理且 NO_PROXY 没列回环时，指向本地实例的请求也走代理：连不上本地服务，明文 http 下 bearer token 经过代理	localhost、127.0.0.1、[::1]（undici NO_PROXY 匹配用带方括号的 IPv6 写法）始终并入 noProxy，与 requireSecureUrl 允许明文的回环集合一致	keeps loopback direct even when NO_PROXY does not list it
2	代理变量无法解析时 EnvHttpProxyAgent 抛错，build / bundle / schema 等离线命令也失败	捕获后在 stderr 提示并直连	skips a proxy setting it cannot use…；另实测：在装好依赖的页面工程里 HTTPS_PROXY="not a url" tinyui build 只打一行提示，照常产出两页 .jsb
3	HTTP_PROXY="" 时 ?? 取到空串，遮住已配置的 http_proxy	?? 改 `

反向验证：把三处改回 0.9.1 写法，对应三条测试失败。

本地按 CI 顺序 build / schema:check / runtime:check / typecheck / test 全过（core 43、native 12、cli 96）；挂代理端到端 tinyui pull 成功。

🤖 Generated with Claude Code

Summary by Sourcery

Make CLI proxy handling safer and more resilient for local and offline workflows.

Bug Fixes:

• Ensure requests to loopback addresses bypass configured proxies.
• Fall back to direct connections when proxy settings are invalid instead of breaking commands.
• Allow lowercase proxy variables to be used when uppercase variables are empty.

Documentation:

• Document loopback bypass and invalid-proxy fallback behavior for CLI networking.

Tests:

• Add coverage for loopback proxy bypass, lowercase environment fallback, invalid proxy handling, and resetting stale proxy dispatchers.

Chores:

• Bump the core, native, and CLI packages to version 0.9.2.

[sourcery-ai]

Reviewer's Guide

This release hardens CLI proxy handling by forcing loopback requests to bypass proxies, tolerating invalid proxy settings through a stderr warning and direct fallback, and correctly honoring lowercase variables when uppercase values are empty; it also adds focused tests, documentation, and 0.9.2 version updates.

Sequence diagram for resilient CLI proxy setup

sequenceDiagram
    participant CLI
    participant Env
    participant EnvHttpProxyAgent
    participant Fetch
    participant Updates

    CLI->>Env: useEnvProxy()
    Env-->>CLI: Read proxy variables
    alt No usable proxy
        CLI-->>Fetch: Use direct connection
    else Proxy configured
        CLI->>EnvHttpProxyAgent: Create with noProxy including localhost, 127.0.0.1, [::1]
        alt Proxy settings valid
            EnvHttpProxyAgent-->>CLI: Agent configured
            CLI->>Fetch: Install global dispatcher
            Fetch->>Updates: Request
        else Proxy settings invalid
            EnvHttpProxyAgent-->>CLI: Throw error
            CLI->>CLI: Write warning to stderr
            CLI-->>Fetch: Use direct connection
        end
    end

Loading

Flow diagram for CLI proxy environment fallback

flowchart TD
    A[Read HTTP_PROXY and HTTPS_PROXY] --> B{Uppercase value is empty?}
    B -->|Yes| C[Use lowercase variable]
    B -->|No| D[Use uppercase variable]
    C --> E{Usable proxy configured?}
    D --> E
    E -->|No| F[Direct connection]
    E -->|Yes| G[Add loopback hosts to noProxy]
    G --> H{EnvHttpProxyAgent accepts settings?}
    H -->|Yes| I[Use proxy except loopback]
    H -->|No| J[Warn on stderr]
    J --> F

Loading

File-Level Changes

Change	Details	Files
Hardens CLI proxy setup for local endpoints and invalid environment configuration.	Always appends localhost, 127.0.0.1, and bracketed ::1 to NO_PROXY so loopback requests bypass the proxy. Falls back from empty uppercase proxy variables to lowercase values and avoids loading the proxy agent when no usable proxy is configured. Catches EnvHttpProxyAgent construction errors, reports them on stderr, and preserves direct connectivity for offline commands. Adds tests covering loopback bypass, lowercase fallback, empty variables, and invalid proxy URLs.	packages/cli/src/proxy.ts packages/cli/test/proxy.test.ts
Documents the revised proxy behavior and advances the release version to 0.9.2.	Updates CLI documentation to describe loopback direct routing and graceful handling of invalid proxy settings. Bumps CLI, core, and native package versions; updates the core runtime version constant.	packages/cli/README.md packages/cli/package.json packages/core/package.json packages/core/src/version.ts packages/native/package.json packages/native/src/index.ts

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 64678d29-c564-4c5d-8aa7-588b2c386d7b

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[codeseerbot]

CodeSeer 审查

结论：批准（附 1 条建议）

摘要

本次改动为 CLI 代理配置增加了回环地址直连、无效代理配置降级直连以及大小写环境变量的空串回退，并同步将各包及生成字节码版本更新到 0.9.2。代理初始化失败时的常规单次 CLI 执行可以正常返回，但重复调用 useEnvProxy 时会保留之前的全局代理 dispatcher，和“直连”的降级语义不一致。

_{整个 PR 至 c5f5099 · gpt-5.6-terra}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. If the proxy selection or loopback exclusion is wrong, requests carrying update-service bearer tokens could be sent through an unintended proxy or fail to reach a local service, exposing credentials or causing an already-completed request to be misrouted. Reverting restores the prior proxy behavior, but any credentials exposed during the faulty interval cannot be recovered.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codeseerbot]

CodeSeer 审查

结论：批准

上轮意见：1 条，已处理 1 条，待处理 0 条

摘要

本次增量在代理配置解析失败时，复用已加载的 undici 模块显式安装新的直连 Agent，避免此前设置的代理 dispatcher 残留。新增测试覆盖了先成功设置代理、再传入无效代理配置的状态切换，并验证请求不会继续通过旧代理。上轮关于失败分支仍使用旧代理的意见已得到修复。

_{增量 c5f5099..69f3f2d · gpt-5.6-terra}