fix: refactor auto-discovery for OS proxy settings (#654)

# Problem

Related PRs:
- #553
- #595 (Original)
- #604 (Reverted PR)

We originally bolted on an exec-time shim that `require.resolve’d`
[os-proxy-config](https://www.npmjs.com/package/os-proxy-config) and ran
it in a child-process so we could keep
`ProxyConfigManager.getSystemProxySync()` fully synchronous. This
avoided a ripple-effect async refactor through every SDK-initialisation
call-chain and let us ship quickly, but it also meant the code was never
picked up by Webpack, so the proxy lookup silently no-oped inside the
bundled LSP.


## Solution

- Vendored the tiny os-proxy-config implementation directly
(`getMacProxySettings.ts`, `getWindowsProxySettings.ts`) and removed the
child-process shim.
- Reference Code:
[os-proxy-config](https://github.com/httptoolkit/os-proxy-config),
[windows-system-proxy](https://github.com/httptoolkit/windows-system-proxy/tree/main),
[mac-system-proxy](https://github.com/httptoolkit/mac-system-proxy/tree/main)
- Re-wrote the Windows & macOS helpers to expose sync variants (registry
reads with `registry-js` sync API, `scutil --proxy` via `spawnSync`) so
`getSystemProxy()` remains blocking.
- Behaviour is unchanged for callers, but proxy auto-detect now runs in
all packed LSPs because the code is part of the bundle.

## TODO
- Add support for SOCKS Proxy

## Testing

Simulated customer proxy environments on Windows and Mac and tested
plugin build:

- #### Mac

Proxy is being auto-detected and requests are going through proxy:

<img width="1244" alt="Screenshot 2025-07-01 at 12 44 15 AM"
src="https://github.com/user-attachments/assets/53989ccb-c39b-4276-b447-ff3f50cf867a"
/>


- #### Windows

Proxy is being auto-detected and requests are going through proxy:

```
Using bare hostname format, defaulting to HTTP
[Trace - 6:30:06 PM] Received notification 'telemetry/event'.
Params: {
    "name": "runtime_httpProxyConfiguration",
    "result": "Succeeded",
    "data": {
        "proxyMode": "AutoDetect",
        "certificatesNumber": 208,
        "proxyUrl": "http://localhost:8888/"
    }
}
```

<img width="1287" alt="Screenshot 2025-07-01 at 6 32 53 PM"
src="https://github.com/user-attachments/assets/494b264c-7049-4a52-81d3-c0b94f91a2ac"
/>


## License

By submitting this pull request, I confirm that my contribution is made
under the terms of the Apache 2.0 license.

Author: tsmithsz

package-lock.json

@@ -45,12 +45,12 @@
         "hpagent": "^1.2.0",
         "jose": "^5.9.6",
         "mac-ca": "^3.1.1",
-        "os-proxy-config": "^1.1.2",
         "rxjs": "^7.8.2",
         "vscode-languageserver": "^9.0.1",
         "vscode-languageserver-protocol": "^3.17.5",
         "vscode-uri": "^3.1.0",
-        "win-ca": "^3.5.1"
+        "win-ca": "^3.5.1",
+        "registry-js": "^1.16.1"
     },
     "devDependencies": {
         "@types/mocha": "^10.0.9",

runtimes/package.json

@@ -13,8 +13,8 @@ import { NodeHttpHandler } from '@smithy/node-http-handler'
 import { readMacosCertificates, readLinuxCertificates, readWindowsCertificates } from './certificatesReaders'
 import { Telemetry } from '../../../server-interface'
 import { OperationalTelemetryProvider, TELEMETRY_SCOPES } from '../../operational-telemetry/operational-telemetry'
-import { pathToFileURL } from 'node:url'
-import { execFileSync } from 'node:child_process'
+import { getMacSystemProxy } from './getProxySettings/getMacProxySettings'
+import { getWindowsSystemProxy } from './getProxySettings/getWindowsProxySettings'
 
 export class ProxyConfigManager {
     /**
@@ -71,35 +71,14 @@ export class ProxyConfigManager {
         return undefined
     }
 
-    private static getSystemProxySync(): string | undefined {
-        try {
-            const resolved = require.resolve('os-proxy-config')
-            const resolvedUrl = pathToFileURL(resolved).href
-
-            const snippet = `
-                (async () => {
-                    try {
-                        const mod = await import(${JSON.stringify(resolvedUrl)});
-                        const r   = await mod.getSystemProxy();
-                        console.log(JSON.stringify(r ?? {}));
-                    } catch (e) {
-                        console.error(e?.message ?? e);
-                        console.log("{}");
-                    }
-                })();
-            `
-
-            const raw = execFileSync(process.execPath, ['-e', snippet], {
-                encoding: 'utf8',
-                stdio: ['ignore', 'pipe', 'inherit'],
-            })
-
-            console.debug(`os-proxy-config output: ${raw}`)
-            const { proxyUrl } = JSON.parse(raw.trim() || '{}')
-            return proxyUrl && /^https?:\/\//.test(proxyUrl) ? proxyUrl : undefined
-        } catch (err) {
-            console.warn('os‑proxy‑config shim failed:', (err as Error).message)
-            return undefined
+    private static getSystemProxy(): string | undefined {
+        switch (process.platform) {
+            case 'darwin':
+                return getMacSystemProxy()?.proxyUrl
+            case 'win32':
+                return getWindowsSystemProxy()?.proxyUrl
+            default:
+                return undefined
         }
     }
 
@@ -209,7 +188,7 @@ export class ProxyConfigManager {
         }
 
         // Fall back to OS auto‑detect (HTTP or HTTPS only)
-        const sysProxyUrl = ProxyConfigManager.getSystemProxySync()
+        const sysProxyUrl = ProxyConfigManager.getSystemProxy()
         if (sysProxyUrl) {
             this.emitProxyMetric('AutoDetect', certs.length, sysProxyUrl)
             return new HttpsProxyAgent({ ...agentOptions, proxy: sysProxyUrl })

runtimes/runtimes/util/standalone/experimentalProxyUtil.ts

@@ -0,0 +1,42 @@
+/*
+ * Based on mac-system-proxy 1.0.2 (Apache-2.0). Modified for synchronous use
+ * https://github.com/httptoolkit/mac-system-proxy/blob/main/test/index.spec.ts
+ */
+import * as assert from 'assert'
+import { getMacSystemProxy } from './getMacProxySettings'
+
+describe('getMacSystemProxy', () => {
+    it('can get the Mac system proxy', function () {
+        if (process.platform !== 'darwin') return this.skip()
+
+        const result = getMacSystemProxy()
+        assert.ok(result === undefined || (typeof result === 'object' && result !== null))
+
+        if (result) {
+            assert.strictEqual(typeof result.proxyUrl, 'string')
+            assert.ok(Array.isArray(result.noProxy))
+        }
+    })
+
+    it('returns undefined on non-Mac platforms', function () {
+        if (process.platform === 'darwin') return this.skip()
+
+        const result = getMacSystemProxy()
+        assert.strictEqual(result, undefined)
+    })
+
+    it('handles scutil command failure gracefully', function () {
+        // This test verifies the function doesn't throw
+        assert.doesNotThrow(() => getMacSystemProxy())
+    })
+
+    it('returns undefined when no proxy is configured', function () {
+        if (process.platform !== 'darwin') return this.skip()
+
+        const result = getMacSystemProxy()
+        if (result) {
+            assert.strictEqual(typeof result.proxyUrl, 'string')
+            assert.ok(Array.isArray(result.noProxy))
+        }
+    })
+})

runtimes/runtimes/util/standalone/getProxySettings/getMacProxySettings.test.ts

@@ -0,0 +1,59 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Based on mac-system-proxy 1.0.2 (Apache-2.0). Modified for synchronous use
+ * https://github.com/httptoolkit/mac-system-proxy/blob/main/src/index.ts
+ */
+import { spawnSync } from 'child_process'
+import { parseScutilOutput } from './parseScutil'
+
+export interface ProxyConfig {
+    proxyUrl: string
+    noProxy: string[]
+}
+
+export function getMacSystemProxy(): ProxyConfig | undefined {
+    // Invoke `scutil --proxy` synchronously
+    console.debug('Executing scutil --proxy to retrieve Mac system proxy settings')
+    const result = spawnSync('scutil', ['--proxy'], { encoding: 'utf8' })
+    if (result.error || result.status !== 0) {
+        console.warn(`scutil --proxy failed: ${result.error?.message ?? 'exit code ' + result.status}`)
+        return undefined
+    }
+    console.debug('Successfully retrieved scutil output')
+
+    let settings: Record<string, any>
+    try {
+        settings = parseScutilOutput(result.stdout)
+    } catch (e: any) {
+        console.warn(`Failed to parse scutil output: ${e.message}`)
+        return undefined
+    }
+
+    const noProxy = settings.ExceptionsList ?? []
+
+    // Honor PAC URL first if configured
+    if (settings.ProxyAutoConfigEnable === '1' && settings.ProxyAutoConfigURLString) {
+        console.debug(`Using PAC URL: ${settings.ProxyAutoConfigURLString}`)
+        return { proxyUrl: settings.ProxyAutoConfigURLString, noProxy }
+    }
+
+    // Otherwise pick the first enabled protocol
+    console.debug('Checking for enabled proxy protocols')
+    if (settings.HTTPEnable === '1' && settings.HTTPProxy && settings.HTTPPort) {
+        console.debug(`Using HTTP proxy: ${settings.HTTPProxy}:${settings.HTTPPort}`)
+        return { proxyUrl: `http://${settings.HTTPProxy}:${settings.HTTPPort}`, noProxy }
+    }
+    if (settings.HTTPSEnable === '1' && settings.HTTPSProxy && settings.HTTPSPort) {
+        console.debug(`Using HTTPS proxy: ${settings.HTTPSProxy}:${settings.HTTPSPort}`)
+        return { proxyUrl: `http://${settings.HTTPSProxy}:${settings.HTTPSPort}`, noProxy }
+    }
+    // TODO: Enable support for SOCKS Proxy
+    // if (settings.SOCKSEnable === '1' && settings.SOCKSProxy && settings.SOCKSPort) {
+    //     console.debug(`Using SOCKS proxy: ${settings.SOCKSProxy}:${settings.SOCKSPort}`)
+    //     return { proxyUrl: `socks://${settings.SOCKSProxy}:${settings.SOCKSPort}`, noProxy }
+    // }
+
+    return undefined
+}

runtimes/runtimes/util/standalone/getProxySettings/getMacProxySettings.ts

@@ -0,0 +1,32 @@
+/*
+ * Based on windows-system-proxy 1.0.0 (Apache-2.0).
+ * https://github.com/httptoolkit/windows-system-proxy/blob/main/test/index.spec.ts
+ */
+import * as assert from 'assert'
+import { getWindowsSystemProxy } from './getWindowsProxySettings'
+
+describe('getWindowsSystemProxy', () => {
+    it('can get the Windows system proxy', function () {
+        if (process.platform !== 'win32') return this.skip()
+
+        const result = getWindowsSystemProxy()
+        assert.ok(result === undefined || (typeof result === 'object' && result !== null))
+
+        if (result) {
+            assert.strictEqual(typeof result.proxyUrl, 'string')
+            assert.ok(Array.isArray(result.noProxy))
+        }
+    })
+
+    it('returns undefined on non-Windows platforms', function () {
+        if (process.platform === 'win32') return this.skip()
+
+        const result = getWindowsSystemProxy()
+        assert.strictEqual(result, undefined)
+    })
+
+    it('handles registry access failure gracefully', function () {
+        // This test verifies the function doesn't throw
+        assert.doesNotThrow(() => getWindowsSystemProxy())
+    })
+})

runtimes/runtimes/util/standalone/getProxySettings/getWindowsProxySettings.test.ts

@@ -0,0 +1,82 @@
+/*!
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Based on windows-system-proxy 1.0.0 (Apache-2.0). Modified for synchronous use
+ * https://github.com/httptoolkit/windows-system-proxy/blob/main/src/index.ts
+ */
+import { enumerateValues, HKEY, RegistryValue } from 'registry-js'
+
+export interface ProxyConfig {
+    proxyUrl: string
+    noProxy: string[]
+}
+
+export function getWindowsSystemProxy(): ProxyConfig | undefined {
+    const proxyValues = enumerateValues(
+        HKEY.HKEY_CURRENT_USER,
+        'Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings'
+    )
+    console.debug(`Retrieved ${proxyValues.length} registry values for proxy settings`)
+
+    const proxyEnabled = getValue(proxyValues, 'ProxyEnable')
+    const proxyServer = getValue(proxyValues, 'ProxyServer')
+
+    if (!proxyEnabled || !proxyEnabled.data || !proxyServer || !proxyServer.data) {
+        console.debug('Proxy not enabled or server not configured')
+        return undefined
+    }
+
+    // Build noProxy list from ProxyOverride (semicolon-separated, with <local> → localhost,127.0.0.1,::1)
+    const proxyOverride = getValue(proxyValues, 'ProxyOverride')?.data
+    const noProxy = (proxyOverride ? (proxyOverride as string).split(';') : []).flatMap(host =>
+        host === '<local>' ? ['localhost', '127.0.0.1', '::1'] : [host]
+    )
+
+    // Parse proxy configuration which can be in multiple formats
+    const proxyConfigString = proxyServer.data as string
+
+    if (proxyConfigString.startsWith('http://') || proxyConfigString.startsWith('https://')) {
+        console.debug('Using full URL format proxy configuration')
+        // Handle full URL format (documented in Microsoft registry configuration guide)
+        // https://docs.microsoft.com/en-us/troubleshoot/windows-client/networking/configure-client-proxy-server-settings-by-registry-file
+        return {
+            proxyUrl: proxyConfigString,
+            noProxy,
+        }
+    } else if (proxyConfigString.includes('=')) {
+        console.debug('Using protocol-specific format proxy configuration')
+        // Handle protocol-specific format: protocol=host;protocol=host pairs
+        // Prefer HTTPS, then HTTP, then SOCKS proxy
+        const proxies = Object.fromEntries(
+            proxyConfigString.split(';').map(proxyPair => proxyPair.split('=') as [string, string])
+        )
+
+        const proxyUrl = proxies['https']
+            ? `https://${proxies['https']}`
+            : proxies['http']
+              ? `http://${proxies['http']}`
+              : // TODO: Enable support for SOCKS Proxy
+                // proxies['socks'] ? `socks://${proxies['socks']}`:
+                undefined
+
+        if (!proxyUrl) {
+            throw new Error(`Could not get usable proxy URL from ${proxyConfigString}`)
+        }
+        console.debug(`Selected proxy URL: ${proxyUrl}`)
+
+        return {
+            proxyUrl,
+            noProxy,
+        }
+    } else {
+        console.debug('Using bare hostname format, defaulting to HTTP')
+        // Handle bare hostname format, default to HTTP
+        return {
+            proxyUrl: `http://${proxyConfigString}`,
+            noProxy,
+        }
+    }
+}
+
+const getValue = (values: readonly RegistryValue[], name: string) => values.find(value => value?.name === name)