Wildcard subdomains in NO_PROXY are not respected

[ashenstrata]

Description

I'm using a proxy with opencode TUI. I want to exclude all subdomains of a certain domain from going through it. I'm doing this by adding *.example.com to $NO_PROXY. However, opencode is still routing calls to a provider on foo.bar.example.com through the proxy. Only if I specify the full domain foo.bar.example.com does it function correctly.

Here's a representation of my setup:

export GATEWAY_PROXY="http://gateway.local:2080"
export NO_PROXY="localhost,127.0.0.1,192.168.*,*.local,*.example.com"

HTTP_PROXY=$GATEWAY_PROXY HTTPS_PROXY=$GATEWAY_PROXY opencode

{
  "$schema": "https://opencode.ai/config.json",
  "autoupdate": "notify",
  "share": "disabled",
  "provider": {
    "ozon": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "foo",
      "options": {
        "baseURL": "https://foo.bar.example.com/api",
        "apiKey": "foo"
      },
      "models": {}
    }
  }
}

Plugins

none

OpenCode version

1.1.36

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

macOS 26.2

Terminal

Ghostty

[github-actions]

This issue might be a duplicate of existing issues. Please check:

• Opencode not respecting NO_PROXY variable #8822: Opencode not respecting NO_PROXY variable with wildcard subdomains (*.org.com)

Both issues describe the same problem where wildcard NO_PROXY entries (e.g., *.example.com) are not being respected, requiring full domain specification as a workaround.

Feel free to ignore if this doesn't address your specific case.

[rekram1-node]

Think this is probably a bun bug, ur using the tui right?

[ashenstrata]

Yes, the TUI

[Thesam1798]

Fix available in PR #10856

This issue is specifically addressed by PR #10856.

Your use case:

NO_PROXY="localhost,127.0.0.1,192.168.*,*.local,*.example.com"

Provider on foo.bar.example.com should bypass the proxy.

Our implementation:
The shouldBypassProxy() function in packages/opencode/src/util/fetch.ts handles wildcards correctly:

// Wildcard: *.example.com
if (p.startsWith("*.") && hostname.endsWith(p.slice(1))) return true

This means *.example.com matches:

• ✅ foo.example.com
• ✅ foo.bar.example.com
• ✅ a.b.c.d.example.com

I've added a specific regression test for this case:

test("matches deep subdomain wildcards (#10710)", () => {
  expect(shouldBypassProxy("foo.bar.example.com", ["*.example.com"])).toBe(true)
  expect(shouldBypassProxy("a.b.c.d.example.com", ["*.example.com"])).toBe(true)
})

The fix works independently of Bun's native proxy handling - we implement our own pattern matching.

[github-actions]

To stay organized issues are automatically closed after 90 days of no activity. If the issue is still relevant please open a new one.