fix(embed): honor proxy env for non-loopback endpoints - #130
Merged
Conversation
The embedding client set Proxy: nil on its http.Transport — intended to keep local Ollama instances off corporate proxies, but it also disabled proxy env for every remote endpoint. Behind credential gateways that inject auth at the proxy boundary (a transparent HTTPS_PROXY), remote OpenAI-compatible providers became unreachable: the client bypassed the gateway, then failed with 401 because the key only exists gateway-side. Route by endpoint instead: loopback (localhost / 127.0.0.0/8 / ::1) never uses a proxy; everything else resolves through the standard HTTPS_PROXY/HTTP_PROXY/NO_PROXY environment. The loopback branch returns an explicit no-proxy resolver rather than nil, which panics when the Transport invokes it.
362224222
pushed a commit
to 362224222/mnemon
that referenced
this pull request
Sep 12, 2026
Syncs 26 upstream commits (PR mnemon-dev#87-mnemon-dev#130) into the Windows/embed.yml fork line: readonly write hardening and SQLite URI normalization (v0.2.7), token-friendly brief retrieval, npm-managed distribution and `mnemon update`, and the embed proxy/probe fixes. Merged upstream/master rather than the v0.2.8 tag so the proxy fix ships with it, since this fork's default OpenAI endpoint is remote. Conflict resolution keeps embed.yml as the sole embedding configuration source. Upstream's new embed tests inject config through EmbedConfigFile instead of MNEMON_EMBED_* env; without that rewrite four of them would have silently targeted the default SiliconFlow endpoint over the network. Docs keep the embed.yml wording while adopting upstream's retention table and the sharper --readonly description, and the reworked TestOpenAIEmbed restores the dimensions coverage upstream added. Two Windows gaps are closed so the deterministic tier is meaningful here. TestCodexPrimeHook skips on Windows because its isolated PATH is built from symlinks that carry no .exe suffix, so no shim resolves; TestCodexUserPromptHook still runs. The Makefile drops the Unix-only test/mnemond suites under GOOS=windows, where naming them explicitly aborted with 'build constraints exclude all Go files'. Both packages were already red on the fork baseline; they stay in the tier on other platforms. Validated: go build ./... and go vet ./... on windows and linux, GOOS=windows go vet ./..., and make test green with all 14 embed tests passing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The embedding client's
http.Transportnow resolves its proxy from the environment (HTTPS_PROXY/HTTP_PROXY/NO_PROXY) for non-loopback endpoints, and never uses a proxy for loopback endpoints.Why
NewClientWithModelsetProxy: nilon the transport. The comment said "Bypass system proxy for localhost connections" — butProxy: nildisables proxy env for every endpoint, not just localhost. Two consequences:HTTPS_PROXY, as used by e.g. OneCLI-style agent gateways), remote OpenAI-compatible embedding providers become unreachable: the client bypasses the gateway and hits the provider directly, then fails with 401 because the API key only exists gateway-side.Routing by endpoint fixes both: loopback never proxied, remote endpoints follow standard env resolution (so gateways work), and corporate proxies stop breaking local setups in the opposite direction.
One subtlety: the loopback branch returns an explicit no-proxy resolver (
func(*http.Request) (*url.URL, error) { return nil, nil }) rather thannil, because a nilTransport.Proxypanics when invoked.Follow-up to #127 (same area, found while wiring up a Voyage AI backend behind a credential gateway).
Checklist
make test)make test-integration, when affected)