Add opt-in container proxy configuration (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, NO_PROXY)

[Copilot]

Sandbox containers behind a local proxy (e.g. Clash on macOS + Podman) can't reach external APIs because they don't inherit host proxy settings. The container's loopback (127.0.0.1) isn't the host's loopback, so users must explicitly configure host.containers.internal as the proxy host.

This adds first-class support for HTTP_PROXY, HTTPS_PROXY, ALL_PROXY, and NO_PROXY in ~/.wallfacer/.env. These flow into containers via the existing --env-file mechanism — no container launch changes needed. All fields default to empty; users without a proxy are unaffected.

Backend

• internal/envconfig: add proxy fields to Config, Updates, knownKeys, Parse(), Update()
• internal/handler/env.go: expose proxy fields in GET /PUT /api/env response/request structs

Frontend

• New "Container Proxy (opt-in)" section in Settings → Sandbox with guidance for macOS/Podman:

HTTP_PROXY=http://host.containers.internal:7897
HTTPS_PROXY=http://host.containers.internal:7897
ALL_PROXY=http://host.containers.internal:7897
NO_PROXY=127.0.0.1,localhost,host.containers.internal

Docs

• docs/guide/configuration.md: new "Container Proxy" reference section with env var table
• AGENTS.md: list proxy vars in the optional env vars section

Tests

• envconfig_test.go: parse, parse-absent, and update+clear round-trip for all proxy fields
• envconfig-coverage.test.js: buildSaveEnvPayload with proxy fields set and empty

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• api.anthropic.com
  • Triggering command: /tmp/go-build3333224444/b277/handler.test /tmp/go-build3333224444/b277/handler.test -test.testlogfile=/tmp/go-build3333224444/b277/testlog.txt -test.paniconexit0 -test.timeout=10m0s -l -git_directory_rtest@example.com t Codex708121876/002/podman 2034949/b192/vetgit-receive-pack t iptables Codex708121876/002/podman -c ote649968917/002 /home/REDACTED/go/pkg/mod/golang.o-ifaceassert /home/REDACTED/go/pkg/mod/golang.o-nilfunc -bool t cal/bin/sh /home/REDACTED/go/rev-parse (dns block)
• api.openai.com
  • Triggering command: /tmp/go-build3333224444/b277/handler.test /tmp/go-build3333224444/b277/handler.test -test.testlogfile=/tmp/go-build3333224444/b277/testlog.txt -test.paniconexit0 -test.timeout=10m0s -l -git_directory_rtest@example.com t Codex708121876/002/podman 2034949/b192/vetgit-receive-pack t iptables Codex708121876/002/podman -c ote649968917/002 /home/REDACTED/go/pkg/mod/golang.o-ifaceassert /home/REDACTED/go/pkg/mod/golang.o-nilfunc -bool t cal/bin/sh /home/REDACTED/go/rev-parse (dns block)
• https://api.github.com/repos/latere-ai/images/releases/latest
  • Triggering command: /usr/bin/curl curl -sf REDACTED ux-amd64/pkg/tool/linux_amd64/compile ortc�� g_.a 0.1-go1.25.7.linux-amd64/src/cry--64 ux-amd64/pkg/tool/linux_amd64/vet (http block)
  • Triggering command: /tmp/go-build3333224444/b266/cli.test /tmp/go-build3333224444/b266/cli.test -test.testlogfile=/tmp/go-build3333224444/b266/testlog.txt -test.paniconexit0 -test.timeout=10m0s m/_n�� /tmp/go-build2382034949/b176/vet.cfg l/linux_amd64/vet /home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.7.linux-amd64/pkg/tool/linux_amd64/vecat /proc/cpuinfo | grep "core id" | sort | uniq | wc -l ux-amd64/src/os/bash main l/linux_amd64/ve--noprofile /home/REDACTED/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.7.linux-amd64/pkg/tool/linux_amd64/vet /tmp�� (http block)
  • Triggering command: /tmp/go-build3333224444/b266/cli.test /tmp/go-build3333224444/b266/cli.test -test.run=TestRunExec_Helper -test.count=1 uniq 4912�� 1 0.1-go1.25.7.lin--reporter=verbose 0.1-go1.25.7.linux-amd64/pkg/tool/linux_amd64/vet rg/toolchain@v0.git ux-amd64/src/net-C 0.1-go1.25.7.lin/tmp/TestClearConflictedPathssingle_conflicted_file_is_cleared2444401491/001 0.1-go1.25.7.lincheckout /pro�� 01 0.1-go1.25.7.linux-amd64/pkg/too-ifaceassert 1/x64/bin/node pkg/mod/golang.ogit 0.1-go1.25.7.lin-C 0.1-go1.25.7.lin/tmp/TestRecoverRebaseStateaborts_stale_merge_state439321349/001 1/x64/bin/node (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)