fix: preserve relayAuth for pool-referenced relay proxies (#5716) (#7182)

changelog.d/fixes/5716-proxy-pool-relayauth-dropped.md

@@ -0,0 +1 @@
+- fix(providers): preserve relayAuth for vercel/deno/cloudflare relay proxies referenced by-id from the no-auth-provider Proxy Pool dropdown (#5716)

open-sse/executors/mimocode.ts

@@ -90,6 +90,7 @@ export interface AccountProxyConfig {
     port: number;
     username?: string;
     password?: string;
+    relayAuth?: string;
   } | null;
 }
 

open-sse/executors/opencode.ts

@@ -21,6 +21,7 @@ export interface OpencodeAccountProxyConfig {
     port: number;
     username?: string;
     password?: string;
+    relayAuth?: string;
   } | null;
 }
 

src/sse/services/noAuthProxyResolution.ts

@@ -1,4 +1,5 @@
 import { getProxyById } from "@/lib/db/proxies";
+import { isRelayProxyType, extractRelayAuth } from "@/lib/db/proxies/mappers";
 
 /**
  * #5217 (Gap 1) — Per-account proxy resolution for no-auth providers
@@ -29,6 +30,7 @@ export interface ResolvedAccountProxy {
   port: number;
   username?: string;
   password?: string;
+  relayAuth?: string;
 }
 
 export interface AccountProxyEntry {
@@ -43,6 +45,7 @@ interface ProxyRegistryRecordLike {
   port?: number | string;
   username?: string | null;
   password?: string | null;
+  notes?: string | null;
 }
 
 /** Async lookup of a proxy registry record by id (null when absent). */
@@ -53,12 +56,17 @@ function normalizeRecord(rec: ProxyRegistryRecordLike | Partial<ResolvedAccountP
   if (!host) return null;
   const username = typeof rec.username === "string" ? rec.username : "";
   const password = typeof rec.password === "string" ? rec.password : "";
+  const type = typeof rec.type === "string" && rec.type ? rec.type : "socks5";
+  const relayAuth = isRelayProxyType(type)
+    ? extractRelayAuth((rec as ProxyRegistryRecordLike).notes)
+    : undefined;
   const resolved: ResolvedAccountProxy = {
-    type: typeof rec.type === "string" && rec.type ? rec.type : "socks5",
+    type,
     host,
     port: Number(rec.port) || 0,
     ...(username ? { username } : {}),
     ...(password ? { password } : {}),
+    ...(relayAuth ? { relayAuth } : {}),
   };
   return resolved;
 }

tests/unit/noAuthProxyResolution.relayAuth.test.ts

@@ -0,0 +1,49 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { resolveAccountProxies } from "../../src/sse/services/noAuthProxyResolution.ts";
+
+test("resolveAccountProxies preserves relayAuth for relay-type (vercel/deno/cloudflare) pool proxies", async () => {
+  const fakeVercelProxyRow = {
+    id: "proxy-1",
+    type: "vercel",
+    host: "my-relay-abc123.vercel.app",
+    port: 443,
+    username: null,
+    password: null,
+    notes: JSON.stringify({ relayAuth: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef" }),
+  };
+
+  const resolved = await resolveAccountProxies(
+    [{ fingerprint: "acct-1", proxyId: "proxy-1" }],
+    async (id) => (id === "proxy-1" ? fakeVercelProxyRow : null)
+  );
+
+  const proxy = resolved[0].proxy as unknown as { type?: string; relayAuth?: string };
+  assert.equal(proxy?.type, "vercel");
+  assert.equal(
+    proxy?.relayAuth,
+    "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef",
+    "relayAuth must survive resolveAccountProxies() for relay-type (vercel/deno/cloudflare) proxies"
+  );
+});
+
+test("resolveAccountProxies leaves relayAuth absent for plain non-relay (socks5/http) pool proxies", async () => {
+  const fakeSocksProxyRow = {
+    id: "proxy-2",
+    type: "socks5",
+    host: "1.2.3.4",
+    port: 1080,
+    username: "u",
+    password: "p",
+    notes: JSON.stringify({ relayAuth: "should-not-leak-onto-non-relay-types" }),
+  };
+
+  const resolved = await resolveAccountProxies(
+    [{ fingerprint: "acct-2", proxyId: "proxy-2" }],
+    async (id) => (id === "proxy-2" ? fakeSocksProxyRow : null)
+  );
+
+  const proxy = resolved[0].proxy as unknown as { type?: string; relayAuth?: string };
+  assert.equal(proxy?.type, "socks5");
+  assert.equal(proxy?.relayAuth, undefined);
+});