From 629ca2f9b617a178f53149797df8aa43e7c6b563 Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Thu, 29 Oct 2026 07:23:57 +0100
Subject: [PATCH] fix(server): read Windows proxy environment entries once

---
 packages/server/src/server/network/index.ts   |  6 ++++--
 .../server/src/server/network/network.test.ts | 19 ++++++++++++++++++-
 2 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/packages/server/src/server/network/index.ts b/packages/server/src/server/network/index.ts
index 03ce03c159..c54e9e2cf7 100644
--- a/packages/server/src/server/network/index.ts
+++ b/packages/server/src/server/network/index.ts
@@ -14,9 +14,11 @@ function readEnvironment(env: NodeJS.ProcessEnv): {
   environment: ProxyEnvironment;
   ignored: string[];
 } {
+  // process.env lookups are case-insensitive on Windows. Read each actual entry once.
+  const values = new Map(Object.entries(env));
   const ignored: string[] = [];
   function proxy(variable: string): string | undefined {
-    const value = env[variable];
+    const value = values.get(variable);
     if (value === undefined) return undefined;
     if (!value.trim()) return undefined;
     try {
@@ -36,7 +38,7 @@ function readEnvironment(env: NodeJS.ProcessEnv): {
     environment: {
       httpProxy,
       httpsProxy: proxy("https_proxy") ?? proxy("HTTPS_PROXY") ?? httpProxy,
-      noProxy: env.no_proxy ?? env.NO_PROXY ?? "",
+      noProxy: values.get("no_proxy") ?? values.get("NO_PROXY") ?? "",
     },
     ignored,
   };
diff --git a/packages/server/src/server/network/network.test.ts b/packages/server/src/server/network/network.test.ts
index fc7ef28e00..a35ce91fe8 100644
--- a/packages/server/src/server/network/network.test.ts
+++ b/packages/server/src/server/network/network.test.ts
@@ -136,11 +136,16 @@ test.each([
 
 test("daemon starts with an ignored proxy and writes one redacted warning to daemon.log", async () => {
   const home = await mkdtemp(path.join(os.tmpdir(), "daemon-invalid-proxy-"));
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(
+      ([key]) => !["http_proxy", "https_proxy"].includes(key.toLowerCase()),
+    ),
+  );
   const worker = fork(fileURLToPath(new URL("../daemon-worker.ts", import.meta.url)), [], {
     execArgv: ["--import", "tsx"],
     silent: true,
     env: {
-      ...process.env,
+      ...env,
       PASEO_HOME: home,
       HOME: home,
       USERPROFILE: home,
@@ -206,3 +211,15 @@ test("an ignored lowercase variable falls back to the uppercase variable", async
   await once(socket, "error");
   expect(recorder.tunnels).toEqual(["vendor.invalid:443", "vendor.invalid:443"]);
 });
+
+test("case-insensitive environment access reports a variable only once", () => {
+  const env = new Proxy(
+    { https_proxy: "socks5://127.0.0.1:7890" },
+    {
+      get(target, key) {
+        return Reflect.get(target, typeof key === "string" ? key.toLowerCase() : key);
+      },
+    },
+  );
+  expect(initializeEnvironmentProxy(env)).toEqual(["https_proxy"]);
+});