mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
606aa9a7b0
* fix(providers): honor configured proxy on Grok Build egress The grok-cli executor reaches Grok Build over raw `https.request()` (forced IPv4, to dodge Cloudflare blocking on the direct path) rather than the process-wide patched `fetch()` that every other executor uses. `https.request()` never consults the proxy AsyncLocalStorage context, so the proxy the caller already pinned upstream in chatHelpers.ts (`runWithProxyContext`) was silently ignored on BOTH grok-cli paths: chat inference (`nativePost`) and OAuth token refresh (`nativeHttpsPost`, POST https://auth.x.ai/oauth2/token). User-visible effect: an operator who assigns a proxy to a Grok Build connection (or provider/global scope) still egresses on the host's real IP — an IP leak that defeats account-isolation/anonymity setups, and breaks Grok Build entirely for operators who must egress through a proxy. Fix is delta-only: `resolveGrokRequestDispatch()` reads the already-resolved proxy via the shared `resolveProxyForRequest()` and returns either an HttpsProxyAgent bound to it, or — when no proxy is configured — the existing forced-IPv4 direct options, unchanged. Only HTTP/HTTPS CONNECT proxies are supported on this path; an explicitly configured proxy of another kind (SOCKS5) fails closed rather than silently leaking direct, matching the fail-closed convention for OAuth/account proxies (#3051). The proxy URL is never logged, so proxy credentials cannot leak into logs. Regression test: tests/unit/grok-cli-proxy-selection.test.ts (RED before the fix — `resolveGrokRequestDispatch` did not exist and both request builders hardcoded `family: 4` with no agent; GREEN after). Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> Inspired-by: https://github.com/decolua/9router/pull/2343 * chore(changelog): fragment for #7244 --------- Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com>
235 B
235 B
- fix(providers): honor a configured proxy on Grok Build egress — the grok-cli executor used raw
https.request()and bypassed the proxy context, leaking the host IP on chat inference and OAuth token refresh. (thanks @ryanngit)