Add proxy support for pypi package managers

[Sahilb315]

Closes #139

---

[safedep]

SafeDep Report Summary

Package Details

Package	Malware	Vulnerability	Risky License	Report
github.com/elazarl/goproxy @ v1.8.1 go.mod				🔗
golang.org/x/mod @ v0.31.0 go.mod				🔗
golang.org/x/net @ v0.49.0 go.mod				🔗
golang.org/x/sync @ v0.19.0 go.mod				🔗
golang.org/x/sys @ v0.40.0 go.mod				🔗
golang.org/x/term @ v0.39.0 go.mod				🔗
golang.org/x/text @ v0.33.0 go.mod				🔗
golang.org/x/tools @ v0.40.0 go.mod				🔗

_{This report is generated by SafeDep Github App}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 5 additional flags.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 47.68519% with 113 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.17%. Comparing base (3778d4d) to head (ff0fe98).

Files with missing lines	Patch %	Lines
proxy/interceptors/pypi_registry.go	0.00%	49 Missing ⚠️
proxy/interceptors/pypi_url_parser.go	68.66%	39 Missing and 8 partials ⚠️
proxy/interceptors/factory.go	0.00%	8 Missing ⚠️
cmd/pypi/pip.go	0.00%	2 Missing ⚠️
cmd/pypi/pip3.go	0.00%	2 Missing ⚠️
cmd/pypi/poetry.go	0.00%	2 Missing ⚠️
cmd/pypi/uv.go	0.00%	2 Missing ⚠️
internal/flows/proxy_flow.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #150      +/-   ##
==========================================
+ Coverage   37.77%   38.17%   +0.40%     
==========================================
  Files          84       86       +2     
  Lines        5120     5336     +216     
==========================================
+ Hits         1934     2037     +103     
- Misses       3009     3114     +105     
- Partials      177      185       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR adds proxy-based interception and malware analysis support for the Python (PyPI) ecosystem, aligning pip/uv/poetry behavior with the existing npm proxy flow.

Changes:

• Introduces PyPI-specific URL parsing for files.pythonhosted.org and pypi.org (Simple and JSON APIs), including robust filename parsing for wheels and source distributions.
• Adds a PyPI registry interceptor and hooks it into the proxy interceptor factory and proxy flow, and wires pip/pip3/poetry/uv commands to use ProxyFlow when proxy mode is enabled.
• Updates proxy mode documentation to mark pip, uv, and poetry as fully supported.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
proxy/interceptors/pypi_url_parser_test.go	Provides comprehensive tests for PyPI URL parsing, filename parsing, name normalization, and registry hostname resolution.
proxy/interceptors/pypi_url_parser.go	Implements PyPI URL parsers and helpers for extracting package name/version and file type from registry URLs and filenames.
proxy/interceptors/pypi_registry.go	Defines PyPI registry endpoints and the PypiRegistryInterceptor that drives malware analysis for PyPI downloads via the proxy.
proxy/interceptors/factory.go	Registers the PyPI interceptor and includes PyPI in the set of ecosystems supported by proxy-based interception.
docs/proxy-mode.md	Updates documentation to indicate proxy-mode support for pip, uv, and poetry.
cmd/pypi/uv.go	Switches uv to use common vs. proxy flow based on IsProxyModeEnabled, mirroring npm behavior.
cmd/pypi/poetry.go	Switches poetry to use common vs. proxy flow based on IsProxyModeEnabled.
cmd/pypi/pip3.go	Switches pip3 to use common vs. proxy flow based on IsProxyModeEnabled.
cmd/pypi/pip.go	Switches pip to use common vs. proxy flow based on IsProxyModeEnabled.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

vet Summary Report

This report is generated by vet

Policy Checks

• ✅ Vulnerability
• ✅ Malware
• ✅ License
• ✅ Popularity
• ✅ Maintenance
• ✅ Security Posture
• ✅ Threats

Malicious Package Analysis

Malicious package analysis was performed using SafeDep Cloud API

Malicious Package Analysis Report

Ecosystem	Package	Version	Status	Report
ECOSYSTEM_GO	golang.org/x/sync	0.19.0	✅	🔗
ECOSYSTEM_GO	golang.org/x/mod	0.31.0	✅	🔗
ECOSYSTEM_GO	github.com/elazarl/goproxy	1.8.1	✅	🔗
ECOSYSTEM_GO	golang.org/x/tools	0.40.0	✅	🔗
ECOSYSTEM_GO	golang.org/x/term	0.39.0	✅	🔗
ECOSYSTEM_GO	golang.org/x/net	0.49.0	✅	🔗
ECOSYSTEM_GO	golang.org/x/sys	0.40.0	✅	🔗

• ℹ️ 7 packages have been actively analyzed for malicious behaviour.
• ✅ No malicious packages found.

Note: Some of the package analysis jobs may still be running.Please check back later. Consider increasing the timeout for better coverage.

Changed Packages

Changed Packages

• ✅ [Go] golang.org/x/text@0.33.0
• ✅ [Go] golang.org/x/sync@0.19.0
• ✅ [Go] golang.org/x/mod@0.31.0
• ✅ [Go] github.com/elazarl/goproxy@1.8.1
• ✅ [Go] golang.org/x/tools@0.40.0
• ✅ [Go] golang.org/x/term@0.39.0
• ✅ [Go] golang.org/x/net@0.49.0
• ✅ [Go] golang.org/x/sys@0.40.0

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.