feat: add --external-proxy-bypass for routing domains direct

[lukehinds]

Add a bypass mechanism so that specific domains skip the enterprise proxy and connect directly. Supports exact hostnames and *. wildcard suffixes (case-insensitive), configurable via CLI flag, environment variable (NONO_EXTERNAL_PROXY_BYPASS), or profile JSON.

The bypass matcher is built once at startup in ProxyState and checked per-CONNECT before routing. Bypassed connections enforce strict session token validation and go through the standard host filter, preserving the same security guarantees as external-proxy mode.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces the ability to bypass an external proxy for specific domains in the nono application. This enhancement allows certain traffic to be routed directly, improving performance and compatibility for internal or specific services. The changes include updates to CLI arguments, profile configurations, and proxy handling logic to accommodate the new bypass functionality.

Highlights

• External Proxy Bypass: Introduces a mechanism to bypass the enterprise proxy for specific domains, allowing direct connections. This is configurable via CLI flag, environment variable (NONO_EXTERNAL_PROXY_BYPASS), or profile JSON.
• Configuration Flexibility: Supports exact hostnames and *. wildcard suffixes (case-insensitive) for bypass configuration, providing flexibility in defining bypass rules.
• Security: Bypassed connections enforce strict session token validation and go through the standard host filter, preserving the same security guarantees as external-proxy mode.
• Environment Variable Support: Adds support for configuring the external proxy and bypass hosts via environment variables, enhancing ease of use and automation.

Changelog

• crates/nono-cli/src/capability_ext.rs
  • Added external_proxy_bypass field to Caps struct in tests module.
• crates/nono-cli/src/cli.rs
  • Added external_proxy_bypass argument to SandboxArgs struct, allowing specification of domains to bypass the external proxy.
  • Added NONO_EXTERNAL_PROXY_BYPASS environment variable support for the external_proxy_bypass argument.
  • Added NONO_EXTERNAL_PROXY environment variable support for the external_proxy argument.
• crates/nono-cli/src/main.rs
  • Initialized external_proxy_bypass field in run_why and run_sandbox functions.
  • Added logic to resolve effective external proxy and bypass hosts, considering CLI arguments and profile configurations.
  • Added validation to ensure bypass hosts are not specified without an external proxy.
  • Modified run_sandbox to pass effective_external_proxy and effective_bypass to ExecutionFlags.
  • Added checks to prevent proxy flags in nono wrap.
  • Added check to prevent proxy mode in nono wrap when activated by profile network settings.
• crates/nono-cli/src/profile/mod.rs
  • Added external_proxy and external_proxy_bypass fields to NetworkConfig struct for profile configuration.
  • Updated merge_profiles function to handle merging of external_proxy and external_proxy_bypass from base and child profiles.
• crates/nono-cli/tests/env_vars.rs
  • Added tests for NONO_EXTERNAL_PROXY and NONO_EXTERNAL_PROXY_BYPASS environment variables.
  • Added tests to ensure NONO_EXTERNAL_PROXY_BYPASS requires NONO_EXTERNAL_PROXY.
  • Added tests to ensure --net-allow overrides profile external_proxy.
• crates/nono-proxy/src/config.rs
  • Added bypass_hosts field to ExternalProxyConfig struct for specifying hosts to bypass the external proxy.
  • Added tests for ExternalProxyConfig with bypass hosts.
• crates/nono-proxy/src/external.rs
  • Implemented BypassMatcher struct and associated methods for matching hosts against bypass patterns.
  • Added tests for BypassMatcher to verify correct matching of exact hostnames and wildcard suffixes.
• crates/nono-proxy/src/server.rs
  • Added bypass_matcher field to ProxyState struct.
  • Initialized bypass_matcher in start function based on ExternalProxyConfig.bypass_hosts.
  • Modified handle_connection function to check bypass matcher and route connections directly if a match is found.
  • Enforced strict session token validation for bypassed connections.
• docs/cli/features/network-proxy.mdx
  • Added documentation for bypassing the external proxy, including configuration via CLI flags, profiles, and environment variables.
• docs/cli/features/profiles-groups.mdx
  • Added external_proxy and external_proxy_bypass to the network section description.
• docs/cli/usage/flags.mdx
  • Updated documentation to include --external-proxy-bypass flag and its usage.
  • Updated notes to reflect the addition of --external-proxy-bypass.

Activity

• The pull request introduces a new feature: the ability to bypass the external proxy for specific domains.
• The changes include modifications to CLI arguments, profile configurations, and proxy handling logic.
• The implementation includes a BypassMatcher struct for matching hosts against bypass patterns.
• The documentation has been updated to reflect the new feature and its configuration options.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a new feature allowing users to specify bypass hosts for the external proxy. This includes adding external_proxy_bypass fields to various configuration structs (NetworkConfig, ExternalProxyConfig, SandboxArgs, ExecutionFlags, PreparedSandbox), updating CLI argument parsing and environment variable handling, and implementing a BypassMatcher in the proxy server to determine if a host should bypass the external proxy. The changes also include validation logic to ensure bypass hosts are only specified when an external proxy is configured, and updates to documentation and tests to reflect the new functionality.