fix(api): honor proxy config for direct API calls - #1543

LLM Description written by Claude Code:Claude Opus 5

setupSdk builds an hpagent proxy agent from SOCKET_CLI_API_PROXY, falling back to HTTPS_PROXY / https_proxy / HTTP_PROXY / http_proxy, and hands it to socket-sdk-js. apiFetch built a plain https.Agent and connected straight out, so every call that bypasses the typed SDK ignored the proxy entirely:

• scan report data (socket scan create --report, socket scan report)
• socket scan view
• socket scan diff
• socket package score
• socket threat-feed
• tier1 reachability finalize

That split isn't accidental — those endpoints skip the SDK because they aren't in the OpenAPI spec, as the comment in finalize-tier1-scan.mts says. The second stack was added for a good reason and silently never inherited the proxy handling.

Why this went unnoticed since #526

Setting a proxy env var doesn't mean direct egress is blocked. In most setups the proxy is a policy preference and direct outbound still works, so apiFetch ignoring it is invisible — the request just goes direct and succeeds. It only fails where the proxy is the sole route out. There, socket scan create --report dies with getaddrinfo EAI_AGAIN api.socket.dev — a DNS failure, meaning the request never left the machine — while the org-security-policy request issued concurrently in the same Promise.all through the SDK succeeds.

This is a different failure class from #1124 and the equivalent coana fix from April 2026, which both addressed CA trust behind intercepting proxies (unable to get local issuer certificate, packet length too long). In those environments DNS and direct connections work and only the certificate is wrong, so routing was never addressed.

The change

getHttpsAgent() now builds the same proxy agent setupSdk does. apiFetch needs no change — it already routes everything through _httpsRequestFetch with whatever explicit agent that function returns, so this is a single seam covering all six commands. getDefaultProxyUrl is imported from sdk.mts rather than reimplemented, so the two stacks can't drift on which env vars they read.

Also adds tests pinning proxy routing, since the absence of any such test is why this stayed invisible. They were checked against the unpatched tree — both fail without the change.

Worth a look

• I used proxyRequestOptions for the CA on the proxy hop, while sdk.mts passes proxyConnectOptions. hpagent 1.2.0 destructures only proxyRequestOptions, so the sdk.mts value is silently dropped, and sdk.test.mts pins the wrong key against a mocked constructor so it passes regardless. Impact there is narrow — top-level ca still covers the destination handshake, so only the CA for connecting to an https:// proxy is lost. Left alone to keep this to one behaviour change; happy to fold it in.
• NO_PROXY is still unhonored (hpagent doesn't implement it, and setupSdk has the same gap), and api.mts still has no retry logic. Both deliberate non-goals.