fix(outbound): keep fake-IP opt-in off NO_PROXY routes

[Ingwannu]

Summary

• grant the 198.18/15 fake-IP DNS exception only when the exact provider host will use the configured proxy
• keep NO_PROXY-matched hosts on the ordinary direct-route destination policy, where benchmark answers remain blocked
• add a regression proving neither proxy fetch nor pinned direct transport runs for a NO_PROXY-matched fake-IP answer

Follow-up to #2037 and the remaining per-host routing boundary in #1748.

Verification

• taskset -c 0,1 bun test tests/provider-outbound.test.ts tests/destination-policy-resolved.test.ts — 44 passed
• taskset -c 0,1 bun run typecheck
• taskset -c 0,1 bun run privacy:scan
• git diff --check

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed (the existing code comment now matches the per-host proxy boundary; no public option changed).
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Improved provider DNS validation when proxies and NO_PROXY rules are configured.
  • Hosts bypassing the proxy now continue to reject benchmark addresses, preventing incorrect routing behavior.

• Tests

  • Added regression coverage for NO_PROXY hosts and benchmark-address validation.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3b4ca600-c8d8-4df8-bc34-4ad7124dde86

📥 Commits

Reviewing files that changed from the base of the PR and between c42d1eb and b92bb61.

📒 Files selected for processing (2)

• src/lib/provider-outbound.ts
• tests/provider-outbound.test.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Provider DNS validation now rejects benchmark addresses for hosts matched by NO_PROXY, even when a proxy is configured. A regression test verifies the resolver option and confirms that failed resolution prevents outbound fetch execution.

Changes

Provider DNS validation

Layer / File(s)	Summary
Proxy-aware benchmark validation src/lib/provider-outbound.ts, tests/provider-outbound.test.ts	Benchmark-address resolution is allowed only when the provider host is not matched by NO_PROXY. The regression test verifies allowBenchmarkAddresses: false, prevents fetch execution after resolution failure, and restores the global fetch mock.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b92bb

The change is localized and supported by regression tests and normal checks; no actionable merge-blocking risk remains.

Suggested reviewers: lidge-j

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: fake-IP opt-in remains disabled for hosts routed through NO_PROXY.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ingw/fix-fakeip-no-proxy-boundary-2037

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Merged. One follow-up recorded from independent review: noProxyMatches (pre-existing helper from #2037's unit, e3bbf53) reads NO_PROXY ?? no_proxy, while Bun's env loader prefers non-empty no_proxy first — when the two variables differ, the matcher and Bun's fetch can disagree about whether a host is proxied, which re-opens a direct fake-IP corner this PR otherwise closes. Since this PR only narrows the allowance (proxyConfigured && !noProxyMatches), it is a strict improvement and the precedence alignment (prefer non-empty lowercase, plus a conflict regression test) is left as a follow-up.