feat(opencode): add HTTP/HTTPS proxy support by Thesam1798 · Pull Request #10856 · anomalyco/opencode

Thesam1798 · 2026-01-27T14:46:35Z

Summary

Bun's native fetch() ignores HTTP_PROXY/HTTPS_PROXY environment variables. This PR adds a proxyFetch wrapper that reads proxy configuration and passes it to Bun's fetch.

Changes

Add ProxyConfig schema in config.ts
Add proxyFetch wrapper in src/util/fetch.ts
Replace all fetch() calls with proxyFetch() across ~20 files
Support NO_PROXY patterns (wildcards, suffixes)
Add OPENCODE_DISABLE_PROXY emergency bypass flag
Add unit and integration tests
Add documentation in docs/proxy.md

Configuration

Environment variables:

export HTTPS_PROXY=http://proxy:8080
export NO_PROXY=localhost,*.internal.com

Or in opencode.json:

{
  "proxy": {
    "https": "http://proxy:8080",
    "no_proxy": ["localhost", "*.internal.com"]
  }
}

Verification

All 822 existing tests pass
Tested manually behind corporate proxy (France Travail)
Verified API calls go through proxy
Verified NO_PROXY bypass works for internal hosts

github-actions · 2026-01-27T14:47:16Z

The following comment was made by an LLM, it may be inaccurate:

Based on my search, I found one potentially related PR:

PR #6025 - feat: add per-provider TLS and proxy configuration

Why it's related:
This PR also addresses proxy configuration support, though it appears to focus on per-provider TLS and proxy settings. Your current PR (10856) is a more recent and comprehensive implementation adding system-wide HTTP/HTTPS proxy support with NO_PROXY pattern matching and environment variable integration.

The searches for "proxyFetch", "NO_PROXY bypass", and specific fetch wrapper implementations only returned your current PR (10856), indicating this is likely a newer implementation approach.

Copilot

Pull request overview

Adds proxy support for Bun-based networking by introducing a proxy-aware fetch wrapper that respects HTTP_PROXY / HTTPS_PROXY / NO_PROXY, plus documentation and tests.

Changes:

Introduces proxyFetch() and NO_PROXY pattern matching in src/util/fetch.ts.
Adds proxy configuration schema to opencode.json via Config.ProxyConfig.
Replaces many direct fetch() calls with proxyFetch() and adds unit/integration tests + docs.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/opencode/src/util/fetch.ts	Adds proxy resolution (`HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY`) and `proxyFetch()` wrapper.
packages/opencode/src/config/config.ts	Adds `ProxyConfig` zod schema and uses `proxyFetch` for remote config fetch.
packages/opencode/src/tool/websearch.ts	Routes Exa websearch requests through `proxyFetch`.
packages/opencode/src/tool/webfetch.ts	Routes web fetching requests through `proxyFetch`.
packages/opencode/src/tool/codesearch.ts	Routes Exa codesearch requests through `proxyFetch`.
packages/opencode/src/share/share.ts	Routes share API calls through `proxyFetch`.
packages/opencode/src/share/share-next.ts	Routes share-next API calls through `proxyFetch`.
packages/opencode/src/session/instruction.ts	Routes instruction URL fetches through `proxyFetch`.
packages/opencode/src/provider/provider.ts	Uses `proxyFetch` in provider fetch hook.
packages/opencode/src/provider/models.ts	Routes model snapshot fetch/refresh through `proxyFetch`.
packages/opencode/src/plugin/copilot.ts	Routes Copilot auth + token polling requests through `proxyFetch`.
packages/opencode/src/plugin/codex.ts	Routes Codex OAuth/token requests through `proxyFetch`.
packages/opencode/src/mcp/index.ts	Injects `proxyFetch` into MCP HTTP/SSE transports.
packages/opencode/src/lsp/server.ts	Routes LSP download and GitHub API calls through `proxyFetch`.
packages/opencode/src/installation/index.ts	Routes version check / registry queries through `proxyFetch`.
packages/opencode/src/file/ripgrep.ts	Routes ripgrep download through `proxyFetch`.
packages/opencode/src/cli/cmd/mcp.ts	Routes MCP debug connectivity request through `proxyFetch`.
packages/opencode/src/cli/cmd/import.ts	Routes share import request through `proxyFetch`.
packages/opencode/src/cli/cmd/github.ts	Routes GitHub integration HTTP calls through `proxyFetch`.
packages/opencode/src/cli/cmd/auth.ts	Routes `.well-known/opencode` fetch through `proxyFetch`.
packages/opencode/test/util/fetch.test.ts	Adds unit tests for proxy config parsing and NO_PROXY matching.
packages/opencode/test/util/fetch-integration.test.ts	Adds opt-in integration tests (skipped in CI) for proxy behavior.
packages/opencode/docs/proxy.md	Documents proxy env vars, config file format, NO_PROXY patterns, and troubleshooting.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/opencode/src/util/fetch.ts

packages/opencode/test/util/fetch.test.ts

packages/opencode/test/util/fetch-integration.test.ts

packages/opencode/src/config/config.ts

packages/opencode/docs/proxy.md

Thesam1798 · 2026-01-27T21:10:28Z

This PR (#10856) implements:

System-wide HTTP/HTTPS proxy support via env vars and opencode.json
NO_PROXY pattern matching (wildcards, suffixes, exact match)
proxyFetch() wrapper for Bun's native fetch
TLS configuration for proxy connections (proxy.tls.ca, proxy.tls.rejectUnauthorized)

PR #6025 focuses on:

Per-provider TLS settings (client certs, mTLS)
Per-provider proxy overrides

The two PRs are complementary - this one provides the global proxy infrastructure, while #6025 will add provider-specific overrides on top of it.

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

packages/opencode/src/util/fetch.ts

packages/opencode/test/util/fetch.test.ts

packages/opencode/test/util/fetch-integration.test.ts

packages/opencode/docs/proxy.md

packages/opencode/src/util/fetch.ts

packages/opencode/docs/proxy.md

Thesam1798 · 2026-01-27T22:02:10Z

Real-world feedback

I encountered this issue with a corporate proxy. Without this fix, opencode was completely unusable:

All providers failed (couldn't reach APIs)
At startup: version checks failed, ripgrep download failed, etc.

After this fix, opencode works perfectly without any special configuration - the HTTP_PROXY/HTTPS_PROXY environment variables are automatically detected.

While waiting for reviews on this PR, I'm using a locally built version and everything works as expected!

andyWang1688 · 2026-02-02T03:36:58Z

Thanks for this PR! I’m a Desktop user behind a corporate proxy and can’t reliably inject env vars into GUI apps. A config-file proxy (opencode.json) would solve this for me. This is blocking adoption on my side—any chance to merge soon?

Add Zod schema for proxy configuration with: - http: HTTP proxy URL - https: HTTPS proxy URL - no_proxy: Array of hosts/patterns to bypass Uses .string() instead of .string().url() for flexibility (supports formats like proxy:8080 without schema). Part of proxy support feature to work around Bun's fetch() ignoring HTTP_PROXY/HTTPS_PROXY environment variables.

Create proxyFetch wrapper that explicitly passes proxy to Bun's fetch() since Bun ignores HTTP_PROXY/HTTPS_PROXY environment variables. Exports: - proxyFetch(input, init) - Main fetch wrapper - getProxyConfig() - Read config/env proxy settings - shouldBypassProxy(hostname, noProxy) - Check NO_PROXY patterns - getProxyForUrl(url) - Resolve proxy for a URL - setProxyConfig(config) - Init from opencode.json config Features: - Config file takes precedence over environment variables - Supports NO_PROXY patterns: *, hostname, *.domain, .domain - Feature flag OPENCODE_DISABLE_PROXY to bypass proxy - Per-request proxy override or disable via init.proxy This is the SPOF (single point of failure) for all proxy support.

Replace native fetch() with proxyFetch() in: - webfetch.ts: Web page fetching tool (2 calls) - websearch.ts: Exa MCP search API (1 call) - codesearch.ts: Exa MCP code search API (1 call)

Replace native fetch() with proxyFetch() in: - share.ts: sync, create, remove (3 calls) - share-next.ts: create, sync, remove (3 calls) These fetch calls communicate with OpenCode sharing API.

Pass proxyFetch to MCP SDK transports via the 'fetch' option: - StreamableHTTPClientTransport (2 instances) - SSEClientTransport (1 instance) The MCP SDK uses internal fetch calls for HTTP communication. By passing our proxyFetch wrapper, remote MCP servers become accessible through corporate proxies. This is critical for users connecting to remote MCP servers like mcp.exa.ai from behind a proxy.

Add proxyFetch import and replace fetch for ESLint server download. This enables ESLint VSCode extension download through corporate proxies.

Replace fetch with proxyFetch for: - ZLS (Zig Language Server): release info + binary download - Clangd (C/C++): release info + binary download These servers download binaries from GitHub releases.

Replace fetch with proxyFetch for: - Elixir-LS: source download - Kotlin LSP: release info - Lua Language Server: release info + binary download - Terraform-LS: release info + binary download - TexLab: release info + binary download - Tinymist: release info + binary download All these servers download binaries from GitHub.

Replace fetch with proxyFetch for ripgrep binary download. This is critical as ripgrep is used for file searching/grep operations.

Replace fetch with proxyFetch for .well-known/opencode endpoint. This enables enterprise config discovery through proxies.

Replace fetch with proxyFetch for remote instruction URLs. This enables loading instructions from remote URLs through proxies.

Replace fetch with proxyFetch in: - copilot.ts: API calls, device code flow, access token flow - codex.ts: Token exchange, token refresh, API calls These plugins use OAuth flows that require external API access.

Replace fetch() with proxyFetch() in CLI command files: - auth.ts: Provider authentication well-known endpoint - import.ts: Session import from opncd.ai URLs - mcp.ts: MCP server list refresh from models.opencode.ai - github.ts: GitHub API calls for Copilot auth and token exchange

Add integration tests that: - Test actual proxy requests (skipped in CI) - Verify NO_PROXY bypass patterns - Test OPENCODE_DISABLE_PROXY flag - Test config override of environment variables Tests require HTTPS_PROXY to be set to run real proxy tests.

Add comprehensive documentation for HTTP/HTTPS proxy support: - Environment variables (HTTP_PROXY, HTTPS_PROXY, NO_PROXY) - Configuration file options (opencode.json proxy section) - NO_PROXY pattern syntax and examples - Troubleshooting guide - Example configurations for common scenarios

- Add tls.rejectUnauthorized and tls.ca options to ProxyConfig schema - Implement getTlsForProxy() with path traversal validation - Wire TLS config into proxyFetch() when proxy is used - Add security warning when certificate validation is disabled Closes #10227

- Test getTlsForProxy() returns undefined when no TLS config - Test rejectUnauthorized option (true/false) - Test CA certificate path handling (single/multiple) - Test path traversal validation throws error

- Add TLS section explaining CA certificate configuration - Document single and multiple CA certificate paths - Document rejectUnauthorized option with security warning - Add reference from SSL/TLS troubleshooting section

- Add env cleanup loop in fetch.test.ts afterEach (Copilot #2) - Dedupe TLS warning to log once per process using Log utility (Copilot #6) - Clarify OPENCODE_DISABLE_PROXY accepts any non-empty value (Copilot #4)

Thesam1798 · 2026-02-15T09:29:14Z

I'll check this week, but I think the latest versions of Bun and Opencode fix this!

If so, I'll close this PR, otherwise I'll continue to update it from my Dev branch.

Thesam1798 · 2026-02-17T08:22:37Z

I tested the native 1.2.6 version, and the issue has been resolved.

Copilot AI review requested due to automatic review settings January 27, 2026 14:46

Copilot started reviewing on behalf of Thesam1798 January 27, 2026 14:46 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

Thesam1798 requested a review from adamdotdevin as a code owner January 27, 2026 21:06

Thesam1798 force-pushed the feature/proxy-support branch from d09d16e to 775ed63 Compare January 27, 2026 21:07

Thesam1798 force-pushed the feature/proxy-support branch 2 times, most recently from 49a10d7 to 45b3b85 Compare January 27, 2026 21:21

Thesam1798 requested a review from Copilot January 27, 2026 21:27

Copilot started reviewing on behalf of Thesam1798 January 27, 2026 21:28 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

Thesam1798 force-pushed the feature/proxy-support branch 2 times, most recently from 062927c to 3f81638 Compare January 28, 2026 13:09

thdxr force-pushed the dev branch from cbab81f to 2d3c7a0 Compare January 30, 2026 04:49

opencode-agent bot force-pushed the dev branch from 00637c0 to 71e0ba2 Compare January 30, 2026 14:32

thdxr force-pushed the dev branch 4 times, most recently from f1ae801 to 08fa7f7 Compare January 30, 2026 14:37

Thesam1798 force-pushed the feature/proxy-support branch from 2823a00 to e121b7d Compare January 31, 2026 16:51

Thesam1798 added 2 commits February 6, 2026 10:08

Thesam1798 added 24 commits February 6, 2026 10:09

refactor(tools): use proxyFetch for webfetch/websearch/codesearch

410dcd8

Replace native fetch() with proxyFetch() in: - webfetch.ts: Web page fetching tool (2 calls) - websearch.ts: Exa MCP search API (1 call) - codesearch.ts: Exa MCP code search API (1 call)

refactor(share): use proxyFetch

34bc348

Replace native fetch() with proxyFetch() in: - share.ts: sync, create, remove (3 calls) - share-next.ts: create, sync, remove (3 calls) These fetch calls communicate with OpenCode sharing API.

refactor(lsp): use proxyFetch for JS/TS servers

4dfb1de

Add proxyFetch import and replace fetch for ESLint server download. This enables ESLint VSCode extension download through corporate proxies.

refactor(lsp): use proxyFetch for system language servers

6b3162d

Replace fetch with proxyFetch for: - ZLS (Zig Language Server): release info + binary download - Clangd (C/C++): release info + binary download These servers download binaries from GitHub releases.

refactor(ripgrep): use proxyFetch for binary download

ad339e7

Replace fetch with proxyFetch for ripgrep binary download. This is critical as ripgrep is used for file searching/grep operations.

refactor(config): use proxyFetch for well-known

b237159

Replace fetch with proxyFetch for .well-known/opencode endpoint. This enables enterprise config discovery through proxies.

refactor(instruction): use proxyFetch for remote instructions

1e4ee24

Replace fetch with proxyFetch for remote instruction URLs. This enables loading instructions from remote URLs through proxies.

refactor(plugins): use proxyFetch for OAuth

ddb25e7

Replace fetch with proxyFetch in: - copilot.ts: API calls, device code flow, access token flow - codex.ts: Token exchange, token refresh, API calls These plugins use OAuth flows that require external API access.

fix(opencode): resolve type intersection for proxy option

c13f25c

fix(opencode): wire proxy config from opencode.json to fetch layer

c824688

test(opencode): improve proxy test cleanup and naming

14e20ba

docs(opencode): replace insecure TLS workaround with proper solutions

cba1dbd

test(opencode): add tests for proxy TLS configuration

2d15b75

- Test getTlsForProxy() returns undefined when no TLS config - Test rejectUnauthorized option (true/false) - Test CA certificate path handling (single/multiple) - Test path traversal validation throws error

docs(opencode): document proxy TLS configuration

9629601

- Add TLS section explaining CA certificate configuration - Document single and multiple CA certificate paths - Document rejectUnauthorized option with security warning - Add reference from SSL/TLS troubleshooting section

fix(opencode): address Copilot review feedback

8a344fd

- Add env cleanup loop in fetch.test.ts afterEach (Copilot #2) - Dedupe TLS warning to log once per process using Log utility (Copilot #6) - Clarify OPENCODE_DISABLE_PROXY accepts any non-empty value (Copilot #4)

test(opencode): add regression tests for issues #6953 and #10710

88e2004

refactor(skill): use proxyFetch for skill discovery downloads

85aac49

refactor(codex): use proxyFetch for OAuth headless flow

292afe5

Thesam1798 force-pushed the feature/proxy-support branch from e121b7d to 292afe5 Compare February 6, 2026 09:29

github-actions bot mentioned this pull request Feb 6, 2026

feat: add OPENCODE_APP_URL for custom web app proxy #12446

Closed

Thesam1798 closed this Feb 17, 2026

Thesam1798 deleted the feature/proxy-support branch February 17, 2026 08:22

Conversation

Thesam1798 commented Jan 27, 2026

Summary

Changes

Configuration

Verification

Uh oh!

github-actions bot commented Jan 27, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Thesam1798 commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Thesam1798 commented Jan 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Real-world feedback

Uh oh!

andyWang1688 commented Feb 2, 2026

Uh oh!

Thesam1798 commented Feb 15, 2026

Uh oh!

Thesam1798 commented Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Thesam1798 commented Jan 27, 2026 •

edited

Loading

Thesam1798 commented Jan 27, 2026 •

edited

Loading