fix(runtime-secrets): pick the boot fetch's proxy with the app's rules

Bun's fetch picks a proxy by scheme only, so with just HTTP_PROXY set the
https Secrets Manager request went direct and a proxy-only container still
could not boot. Move proxy selection (HTTPS_PROXY falling back to HTTP_PROXY,
curl-style NO_PROXY) from apps/sim into @sim/security/environment-proxy, and
have runtime-secrets pass the selected proxy to Bun's fetch explicitly, or
send through the Node handler when NO_PROXY excludes the endpoint.

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -301,7 +301,7 @@ A request through the SSRF guard keeps its checks when it is proxied. Before eac
 
 Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference. AWS clients and OTLP export follow the same rule, so also add an internal S3-compatible store such as MinIO, AWS VPC endpoints, and an in-cluster OpenTelemetry collector.
 
-For the SSRF guard, AWS clients, and OTLP export, Sim matches `NO_PROXY` entries the way curl does: `example.com`, `.example.com`, and `*.example.com` each cover the domain and all its subdomains; `host:port` and `[::1]:port` cover one port; IPv6 entries work bare (`::1`) or bracketed; and CIDR ranges such as `10.0.0.0/8` cover IP-literal destinations only, not hostnames that resolve into the range. Bun's default `fetch`, which carries internal service URLs such as the realtime server and PII service and, behind a proxy, the boot-time Secrets Manager fetch, applies Bun's own `NO_PROXY` rules, which may not honor CIDR or bare IPv6 entries, so list those destinations by hostname.
+For the SSRF guard, AWS clients (including the boot-time Secrets Manager fetch), and OTLP export, Sim matches `NO_PROXY` entries the way curl does: `example.com`, `.example.com`, and `*.example.com` each cover the domain and all its subdomains; `host:port` and `[::1]:port` cover one port; IPv6 entries work bare (`::1`) or bracketed; and CIDR ranges such as `10.0.0.0/8` cover IP-literal destinations only, not hostnames that resolve into the range. Bun's default `fetch`, which carries internal service URLs such as the realtime server and PII service, applies Bun's own `NO_PROXY` rules, which may not honor CIDR or bare IPv6 entries, so list those destinations by hostname.
 
 Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 

apps/sim/lib/core/network/environment-proxy.server.test.ts

@@ -31,7 +31,7 @@ vi.mock('@sim/security/dns', async (importOriginal) => {
   }
 })
 
-import { resolveEnvironmentProxy } from '@/lib/core/network/environment-proxy.server'
+import { resolveEnvironmentProxy } from '@sim/security/environment-proxy'
 import { awsRequestHandler } from '@/lib/core/network/proxy-agent.server'
 import {
   createPinnedFetchWithDispatcher,

apps/sim/lib/core/network/proxy-agent.server.ts

@@ -1,14 +1,14 @@
 import http from 'node:http'
 import https from 'node:https'
 import { isIP } from 'node:net'
+import {
+  isEnvironmentProxyConfigured,
+  resolveEnvironmentProxy,
+} from '@sim/security/environment-proxy'
 import { NodeHttpHandler } from '@smithy/node-http-handler'
 import { Agent, type AgentConnectOpts } from 'agent-base'
 import { HttpProxyAgent } from 'http-proxy-agent'
 import { HttpsProxyAgent } from 'https-proxy-agent'
-import {
-  isEnvironmentProxyConfigured,
-  resolveEnvironmentProxy,
-} from '@/lib/core/network/environment-proxy.server'
 
 /** Matches the AWS SDK's own default agent, so swapping it in changes routing and nothing else. */
 const AGENT_OPTIONS: http.AgentOptions = { keepAlive: true, maxSockets: 50 }

apps/sim/lib/core/network/transport.server.ts

@@ -1,6 +1,6 @@
+import { resolveEnvironmentProxy } from '@sim/security/environment-proxy'
 import { type Agent, type Dispatcher, ProxyAgent, request } from 'undici/index.js'
 import { resolveCurrentOutboundRoute } from '@/lib/core/network/context.server'
-import { resolveEnvironmentProxy } from '@/lib/core/network/environment-proxy.server'
 import { createGatewayDispatcher } from '@/lib/core/network/gateway.server'
 import { OutboundRoutingError } from '@/lib/core/network/routing'
 import type { EgressProfile } from '@/lib/core/security/egress/profiles'

bun.lock

@@ -31,8 +31,10 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "3.1150.0",
     "@sim/logger": "workspace:*",
+    "@sim/security": "workspace:*",
     "@sim/utils": "workspace:*",
-    "@smithy/fetch-http-handler": "5.8.0"
+    "@smithy/fetch-http-handler": "5.8.0",
+    "@smithy/node-http-handler": "4.12.1"
   },
   "devDependencies": {
     "@sim/tsconfig": "workspace:*",

packages/runtime-secrets/package.json

@@ -1,10 +1,15 @@
 import type { GetSecretValueCommandOutput } from '@aws-sdk/client-secrets-manager'
 import { GetSecretValueCommand, SecretsManagerClient } from '@aws-sdk/client-secrets-manager'
 import { createLogger } from '@sim/logger'
+import {
+  isEnvironmentProxyConfigured,
+  resolveEnvironmentProxy,
+} from '@sim/security/environment-proxy'
 import { getErrorMessage } from '@sim/utils/errors'
 import { sleep } from '@sim/utils/helpers'
 import { backoffWithJitter } from '@sim/utils/retry'
 import { FetchHttpHandler } from '@smithy/fetch-http-handler'
+import { NodeHttpHandler } from '@smithy/node-http-handler'
 
 const logger = createLogger('RuntimeSecrets')
 
@@ -71,20 +76,53 @@ export async function fetchRuntimeSecrets(secretId: string): Promise<Record<stri
   )
 }
 
-const PROXY_ENV = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy'] as const
+/**
+ * Sends each request the way the app's `awsRequestHandler` would: through the `HTTPS_PROXY` /
+ * `HTTP_PROXY` that applies to its destination (an https endpoint falls back to `HTTP_PROXY`),
+ * or directly when `NO_PROXY` excludes it, using the same rules from `@sim/security`. Proxied
+ * requests go through Bun's `fetch` with the proxy passed explicitly, since Bun's own lookup
+ * picks a proxy by scheme only and would skip an https endpoint when just `HTTP_PROXY` is set.
+ */
+class EnvironmentProxyHandler extends FetchHttpHandler {
+  private readonly direct = new NodeHttpHandler()
+
+  constructor() {
+    super({
+      customFetch: (input, init) => {
+        const url = input instanceof Request ? input.url : String(input)
+        const proxied: RequestInit & { proxy?: string } = {
+          ...init,
+          proxy: resolveEnvironmentProxy(new URL(url)) ?? undefined,
+        }
+        return fetch(input, proxied)
+      },
+    })
+  }
+
+  override handle(...args: Parameters<FetchHttpHandler['handle']>) {
+    const [request, options] = args
+    const port = request.port ? `:${request.port}` : ''
+    const target = new URL(`${request.protocol}//${request.hostname}${port}`)
+    if (resolveEnvironmentProxy(target)) return super.handle(request, options)
+    return this.direct.handle(request, options)
+  }
+
+  override destroy() {
+    this.direct.destroy()
+    super.destroy()
+  }
+}
 
 /**
  * The SDK's default Node handler ignores `HTTPS_PROXY`, so a container whose only egress is a
- * proxy could not fetch its config and would never boot. While a proxy is set under Bun (both
- * container bootstraps run on Bun), requests go through Bun's `fetch`, which honors
- * `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`. The app's `awsRequestHandler` lives in `apps/sim`,
- * which packages cannot import, and the realtime bootstrap needs this path too. Undefined
- * otherwise, leaving the SDK default in place.
+ * proxy could not fetch its config and would never boot. Both container bootstraps run on Bun,
+ * so while a proxy is set this returns an {@link EnvironmentProxyHandler}. The app's
+ * `awsRequestHandler` lives in `apps/sim`, which packages cannot import. Undefined otherwise,
+ * leaving the SDK default in place.
  */
-function proxyAwareRequestHandler(): FetchHttpHandler | undefined {
-  if (!process.versions.bun) return undefined
-  if (!PROXY_ENV.some((name) => process.env[name]?.trim())) return undefined
-  return new FetchHttpHandler()
+function proxyAwareRequestHandler(): EnvironmentProxyHandler | undefined {
+  if (!process.versions.bun || !isEnvironmentProxyConfigured()) return undefined
+  return new EnvironmentProxyHandler()
 }
 
 async function fetchSecretString(client: SecretsManagerClient, secretId: string): Promise<string> {

packages/runtime-secrets/src/index.ts

@@ -3,7 +3,7 @@ import { createServer, type Server } from 'node:http'
 import type { AddressInfo } from 'node:net'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
-import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 
 const tunnels: string[] = []
 let proxy: Server
@@ -20,39 +20,55 @@ beforeAll(async () => {
   proxyUrl = `http://127.0.0.1:${(proxy.address() as AddressInfo).port}`
 })
 
+beforeEach(() => {
+  tunnels.length = 0
+})
+
 afterAll(async () => {
   proxy.closeAllConnections()
   await new Promise<void>((resolve) => proxy.close(() => resolve()))
 })
 
+/** Runs `loadRuntimeSecrets` in a real Bun process against a Secrets Manager endpoint only the proxy could reach. */
+function loadUnderBun(proxyEnv: Record<string, string>) {
+  const entry = fileURLToPath(new URL('./index.ts', import.meta.url))
+  return promisify(execFile)(
+    'bun',
+    ['--no-env-file', '-e', `await (await import(${JSON.stringify(entry)})).loadRuntimeSecrets()`],
+    {
+      timeout: 20_000,
+      env: {
+        PATH: process.env.PATH,
+        HOME: process.env.HOME,
+        SIM_ENV_SECRET_ID: '/test/sim/env-vars',
+        AWS_REGION: 'us-east-1',
+        AWS_ACCESS_KEY_ID: 'AKIDEXAMPLE',
+        AWS_SECRET_ACCESS_KEY: 'secret',
+        AWS_CONFIG_FILE: '/dev/null',
+        AWS_SHARED_CREDENTIALS_FILE: '/dev/null',
+        AWS_ENDPOINT_URL_SECRETS_MANAGER: 'https://secrets.invalid',
+        ...proxyEnv,
+      },
+    }
+  )
+}
+
 describe('loadRuntimeSecrets under a proxy-only egress', () => {
-  it('reaches Secrets Manager through HTTPS_PROXY under the Bun runtime', async () => {
-    const entry = fileURLToPath(new URL('./index.ts', import.meta.url))
-    const run = promisify(execFile)(
-      'bun',
-      [
-        '--no-env-file',
-        '-e',
-        `await (await import(${JSON.stringify(entry)})).loadRuntimeSecrets()`,
-      ],
-      {
-        timeout: 20_000,
-        env: {
-          PATH: process.env.PATH,
-          HOME: process.env.HOME,
-          SIM_ENV_SECRET_ID: '/test/sim/env-vars',
-          AWS_REGION: 'us-east-1',
-          AWS_ACCESS_KEY_ID: 'AKIDEXAMPLE',
-          AWS_SECRET_ACCESS_KEY: 'secret',
-          AWS_CONFIG_FILE: '/dev/null',
-          AWS_SHARED_CREDENTIALS_FILE: '/dev/null',
-          AWS_ENDPOINT_URL_SECRETS_MANAGER: 'https://secrets.invalid',
-          HTTPS_PROXY: proxyUrl,
-          NO_PROXY: '',
-        },
-      }
+  it.each(['HTTPS_PROXY', 'HTTP_PROXY'])(
+    'reaches Secrets Manager through %s under the Bun runtime',
+    async (name) => {
+      await expect(loadUnderBun({ [name]: proxyUrl })).rejects.toThrow(
+        /Failed to fetch runtime secrets/
+      )
+      expect(tunnels).toContain('secrets.invalid:443')
+    },
+    30_000
+  )
+
+  it('connects directly when NO_PROXY names the Secrets Manager host', async () => {
+    await expect(loadUnderBun({ HTTP_PROXY: proxyUrl, NO_PROXY: '.invalid' })).rejects.toThrow(
+      /Failed to fetch runtime secrets/
     )
-    await expect(run).rejects.toThrow(/Failed to fetch runtime secrets/)
-    expect(tunnels).toContain('secrets.invalid:443')
+    expect(tunnels).toEqual([])
   }, 30_000)
 })

packages/runtime-secrets/src/proxy-egress.test.ts

@@ -26,6 +26,10 @@
       "types": "./src/encryption.ts",
       "default": "./src/encryption.ts"
     },
+    "./environment-proxy": {
+      "types": "./src/environment-proxy.ts",
+      "default": "./src/environment-proxy.ts"
+    },
     "./hash": {
       "types": "./src/hash.ts",
       "default": "./src/hash.ts"

packages/security/package.json

@@ -1,5 +1,5 @@
 import { BlockList, isIP } from 'node:net'
-import { unwrapIpv6Brackets } from '@sim/security/hostnames'
+import { unwrapIpv6Brackets } from './hostnames'
 
 const DEFAULT_PORTS: Record<string, number> = { 'http:': 80, 'https:': 443 }