fix(discovery): carry scheme-bound IPv6 fake-IP admission (#3551) - #3615
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (14)
📝 WalkthroughWalkthroughThe change adds Mihomo IPv6 fake-IP DNS support for provider outbound requests. It selects scheme-specific proxies, excludes ChangesMihomo fake-IP outbound support
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant ProviderOutboundGet
participant EffectiveProxyFor
participant ResolvePublicAddresses
participant Fetch
ProviderOutboundGet->>EffectiveProxyFor: Resolve proxy for URL scheme
EffectiveProxyFor-->>ProviderOutboundGet: Return matching proxy or null
ProviderOutboundGet->>ResolvePublicAddresses: Validate DNS answers with Mihomo opt-in
ResolvePublicAddresses-->>ProviderOutboundGet: Return resolved addresses
ProviderOutboundGet->>Fetch: Send request with explicit proxy when eligible
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7800a744b6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // below reason about the same value. `null` here means "no proxy fetch would actually use", | ||
| // even if some other proxy variable is set. | ||
| const effectiveProxy = effectiveProxyFor(parsed); | ||
| const allowMihomoIpv6FakeIp = effectiveProxy !== null && !noProxyMatches(parsed); |
There was a problem hiding this comment.
When NO_PROXY exists but is blank while no_proxy contains this hostname, noProxyMatches selects the blank uppercase value via ?? and incorrectly returns false. This newly enables the IPv6 fake-IP admission here, after which the request is given an explicit proxy option that bypasses the lowercase exclusion Bun would otherwise honor, routing a deliberately excluded provider through the proxy. Resolve the uppercase/lowercase values using trimmed-value fallback, as effectiveProxyFor and proxyEnvPresent already do, before admitting and binding the request.
Useful? React with 👍 / 👎.
1 participant
Summary
Carries only the child-specific #3551 code onto the corrected Google error parent. The exact Mihomo IPv6 prefix is admitted only when a scheme-matched proxy is captured before DNS and explicitly bound to the request; NO_PROXY and nonmatching destinations retain the denial path. No unrelated stack-ledger files are carried.
Refs #3462. Source security signoff described the boundary as appropriately narrow; its remaining objection was the blocked parent, now corrected in #3608.
Stack (merge bottom-up): IPv6 → launchd → Codex toggle → canonical discovery. This layer targets dev; retarget after its parent lands. These are child-only carries, not wholesale copies of the old parents.
Verification
Checklist
Summary by CodeRabbit
New Features
Documentation