fix(proxy): respect upstream_proxy in TLS CONNECT intercept path (#1048)

[caiocdcs]

The TLS intercept upstream leg (used for credential injection) always connected directly to the target host, ignoring the configured upstream_proxy / external_proxy. In enterprise environments where the target is only reachable through a corporate proxy, this caused the intercepted request to hang or fail.

Issue: #1048

Approach

Two changes in server.rs::handle_connection and tls_intercept::handle::forward_inner_request:

1. server.rs — before entering the intercept path, check the bypass matcher against the target host. If the host should go through the upstream proxy and auth is not configured, pass the proxy address into InterceptCtx as InterceptUpstreamProxy. This mirrors the existing bypass logic for transparent CONNECT.
2. handle.rs — forward_inner_request selects UpstreamStrategy::ExternalProxy when ctx.upstream_proxy is set, falling back to UpstreamStrategy::Direct. The forward.rs pipeline already knew how to chain through a proxy — the intercept path just never asked it to.

Files changed

• crates/nono-proxy/src/tls_intercept/handle.rs — Added InterceptUpstreamProxy struct + upstream_proxy field; strategy selection in forward_inner_request; 3 unit tests.
• crates/nono-proxy/src/tls_intercept/mod.rs — Re-export InterceptUpstreamProxy.
• crates/nono-proxy/src/server.rs — Bypass & auth gate before InterceptCtx construction.

Compliance

• I am not prohibited from contributing under this policy
• An issue already exists (TLS CONNECT interception ignores configured upstream_proxy #1048)
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required (proxy crate uses ProxyError, not applicable to library NonoError)
• I validated and canonicalized all relevant paths (no file path changes in this PR)
• This PR matches the disclosed issue scope

AI-assisted contribution.

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+149
Lines removed	-4
Total changed	153
Classification	Medium (50–300 lines)

Affected crates

• crates/nono-proxy — downstream consumers depend on this crate. API or behaviour changes will affect external callers; treat any breaking change with extra scrutiny.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[gemini-code-assist]

Code Review

This pull request implements upstream proxy chaining for TLS intercepted connections, allowing the upstream leg to route through a corporate proxy when configured. The reviewer suggests extracting the strategy selection logic into a helper function select_upstream_strategy to eliminate code duplication between the production code and the newly added unit tests.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[SequeI]

LGTM, thank you!