fix(server): apply proxy policy to connected host links

packages/server/src/server/connected-hosts/index.ts

@@ -21,6 +21,7 @@ import {
   type HostUpdate,
 } from "@getpaseo/protocol/hosts";
 import type { DaemonPermission, WSHelloMessage } from "@getpaseo/protocol/messages";
+import { webSocketProxyAgent } from "../network/index.js";
 
 export class HostError extends Error {
   constructor(
@@ -242,6 +243,7 @@ export class ConnectedHosts {
       {
         clientId: `host-link-${this.self.serverId}-${row.registrationId}`,
         connectTimeoutMs: 10000,
+        webSocketAgent: webSocketProxyAgent,
       },
       this.budget,
     );

packages/server/src/server/network/network.test.ts

@@ -9,6 +9,7 @@ import { afterEach, expect, test } from "vitest";
 import { WebSocket, WebSocketServer } from "ws";
 import { getGlobalDispatcher, setGlobalDispatcher } from "undici";
 import { initializeEnvironmentProxy, webSocketProxyAgent } from "./index.js";
+import { ConnectedHosts } from "../connected-hosts/index.js";
 const original = getGlobalDispatcher();
 const servers: Server[] = [];
 afterEach(async () => {
@@ -223,3 +224,20 @@ test("case-insensitive environment access reports a variable only once", () => {
   );
   expect(initializeEnvironmentProxy(env)).toEqual(["https_proxy"]);
 });
+
+test("connected-host links send remote WebSockets through the environment proxy", async () => {
+  const recorder = await proxy();
+  initializeEnvironmentProxy({ HTTPS_PROXY: recorder.url });
+  const home = await mkdtemp(path.join(os.tmpdir(), "connected-host-proxy-"));
+  const hosts = new ConnectedHosts(home, { serverId: "self", label: "Self" });
+  try {
+    await hosts.add(
+      { connection: "wss://remote.invalid/ws" },
+      { sourceId: "test", manageSources: true },
+    );
+    await expect.poll(() => recorder.tunnels).toContain("remote.invalid:443");
+  } finally {
+    await hosts.close();
+    await rm(home, { recursive: true, force: true });
+  }
+});