[waldekmastykarz]

Resolves #2060

Problem

A graceful shutdown turns the system proxy off, but a killed or crashed Dev Proxy leaves the OS pointing at a dead port. Even a graceful shutdown only flipped ProxyEnable/proxy state off and left Dev Proxy's ProxyServer value behind, and it turned off any proxy the user had configured before (e.g. a corporate proxy). Crash recovery only existed for detached instances (via state files); a killed foreground instance left nothing to recover from.

Changes

• Snapshot before taking over. SystemProxyManager.Enable records the current OS proxy settings plus the owning PID in system-proxy-backup.json in the Dev Proxy config folder:
  • Windows: previous ProxyEnable / ProxyServer registry values (including "value didn't exist").
  • macOS: per network service web/secure web proxy server, port, and enabled state (networksetup -get[secure]webproxy).
  • An existing snapshot is kept, so a re-enable after a crash doesn't overwrite the original settings with Dev Proxy's.
• Restore instead of just disabling. Disable puts the snapshot back (Windows: set/delete registry values + WinINET refresh; macOS: toggle-proxy.sh off, then networksetup to restore previous servers/states). Without a snapshot it behaves as before. If restoring fails, the snapshot is kept so it can be retried.
• New command: devproxy system-proxy reset [--force]. Restores the settings Dev Proxy changed and removes stale instance records. Refuses (exit 1) when a live Dev Proxy owns the system proxy unless --force is passed. On Linux, where Dev Proxy doesn't change the system proxy, it's a no-op.
• Automatic recovery on startup. Startup reconciliation now also runs for foreground starts (previously only --detach) and treats a snapshot whose PID is dead as a stale registration, so killed foreground instances are recovered too. It never touches settings owned by a live instance.

Notes / decisions

• Command name: the issue suggested devproxy proxy reset (name TBD). I went with devproxy system-proxy reset since devproxy proxy is ambiguous with Dev Proxy itself. Happy to rename.
• Startup cleanup is automatic in all sessions rather than prompting in interactive ones, consistent with the existing detached-mode reconciliation and to avoid blocking startup on input.
• Linux: Dev Proxy doesn't configure gsettings today (it only logs a hint), so there's nothing to snapshot/restore there.
• Docs: the troubleshooting page (No internet connection after using the proxy) lives in the docs repo and should mention devproxy system-proxy reset once this ships.

Testing

• Unit tests for networksetup output parsing, restore command generation, and snapshot store round-trip/corrupt-file handling.
• dotnet build + full DevProxy.Tests pass. Verified devproxy system-proxy reset --help and detached start/stop with --as-system-proxy false. I didn't run the restore against this machine's real system proxy settings.

[Copilot]

🟡 Changes recommended

Proxy recovery can silently fail and delete its backup, while forced resets can disable a restored corporate proxy and configuration errors can block recovery entirely.

5 open issues

• Run proxy recovery before loading configuration and plugins · New
• Prevent shutdown from undoing a forced proxy reset · New
• Treat restore timeouts and nonzero exits as failures · New
• Propagate proxy script failures before deleting the backup · New
• Handle unsupported platforms before checking proxy ownership · New

What changed in this PR

Adds system-proxy recovery to Dev Proxy, preserving previous OS settings so they can be restored after shutdown or a crash.

Changes:

• Saves Windows and macOS proxy settings before Dev Proxy takes over.
• Adds devproxy system-proxy reset [--force] and extends automatic recovery to foreground starts.
• Adds tests for snapshot persistence and macOS parsing and restore commands.

File	Description
DevProxy/​State/​StateManager.cs	Exposes process-liveness checks for recovery.
DevProxy/​Proxy/​SystemProxySnapshot.cs	Adds snapshot storage and macOS settings helpers.
DevProxy/​Proxy/​SystemProxyManager.cs	Captures and restores settings; tracks live and orphaned owners.
DevProxy/​Program.cs	Runs recovery before foreground startup.
DevProxy/​Commands/​SystemProxyCommand.cs	Implements the reset command and force option.
DevProxy/​Commands/​StopCommand.cs	Adapts stop reporting to the revised recovery results.
DevProxy/​Commands/​DevProxyCommand.cs	Registers the system-proxy command.
DevProxy.Tests/​SystemProxyManagerTests.cs	Tests snapshot persistence and macOS helpers.
DevProxy.Abstractions/​Proxy/​ISystemProxyManager.cs	Documents restoration behavior for cleanup.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved ownership, recovery, and concurrency defects can overwrite original proxy backups, disable restored corporate proxies, and report success despite failed recovery.

6 open issues

• Clear proxy ownership after a successful forced reset · New
• Lock snapshot capture and proxy restoration across processes · New
• Propagate recovery failures and preserve records for retry · New
• Fail when network service enumeration fails · New
• Parse standalone reset arguments before changing the OS · New
• Continue restoring services after individual failures · New

5 resolved since last review

• Propagate proxy script failures before deleting the backup
• Treat restore timeouts and nonzero exits as failures
• Prevent shutdown from undoing a forced proxy reset
• Run proxy recovery before loading configuration and plugins
• Handle unsupported platforms before checking proxy ownership

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

A partial proxy-disable failure can skip snapshot restoration, leaving affected network services without their previous corporate proxy settings even after retries.

No open issues 🎉

4 previously missed issues

In code that hasn't changed since last review

Restore proxy snapshots even when disabling a service fails

DevProxy/​Proxy/​SystemProxyManager.cs:154

If toggle-proxy.sh off fails for one network service, it can still successfully disable the proxies on the other services. This condition then skips RestoreMacOS entirely, leaving those working services without their previous corporate proxy; retrying repeats the same problem while the failing service remains. Please attempt snapshot restoration even when the disable pass fails, and combine both results so the backup is still retained on either failure.

Recognize recovery commands with global options in any position

DevProxy/​Commands/​DevProxyCommand.cs:148

The standalone recovery path is still bypassed when a recursive global option appears between the commands. For example, devproxy system-proxy --no-color reset is valid for the registered command tree, but this positional check returns false. It then builds the application host, where an empty plugins configuration throws before recovery runs. Please recognize the parsed command path independently of global-option placement so these valid invocations also work with broken configurations.

Enforce enum validation for standalone options

DevProxy/​Commands/​SystemProxyCommand.cs:56

The registered command validates --output and --log-level as enums, but the standalone path accepts arbitrary strings here. For example, devproxy system-proxy reset --force --log-level typo changes the OS proxy settings instead of rejecting the invalid option before any side effects. Please retain the enum option types in this parser as well.

Validate process start time to prevent stale PID ownership

DevProxy/​Proxy/​SystemProxySnapshot.cs:20

After a crash or reboot, the OS can reuse the saved PID for an unrelated process, causing startup recovery to skip restoration and an unforced reset to refuse it. Persist the owner's process start time alongside its PID, refresh both on takeover, and validate both in the ownership and orphan checks. The snapshot's existing CreatedAt cannot identify the current owner because it is preserved across takeovers.

6 resolved since last review

• Fail when network service enumeration fails
• Propagate recovery failures and preserve records for retry
• Lock snapshot capture and proxy restoration across processes
• Clear proxy ownership after a successful forced reset
• Continue restoring services after individual failures
• Parse standalone reset arguments before changing the OS

_{Review effort: Balanced}

[waldekmastykarz]

Addressing the previously missed issues from the latest review, fixed in d14a489:

• Restore snapshots even when disabling fails: fixed. RestoreMacOS now always runs when a snapshot exists, and either failure keeps the snapshot.
• Global options in any position: fixed. IsSystemProxyResetCommand skips --output/--log-level (and their values) and --no-color before matching the command path.
• Enum validation in the standalone parser: fixed. It now uses Option<OutputFormat?> and Option<LogLevel?>, so --log-level typo is rejected before any OS change.
• PID start-time validation: not changing this here. The existing instance state (StateManager.IsProcessRunning, GetOrphanedSystemProxyStatesAsync, stop, status) identifies instances by PID only. The snapshot follows the same model on purpose, so ownership checks stay consistent across the code. If a PID is reused, the worst case is that automatic cleanup is skipped and reset asks for --force, which the error message explains. Validating start time for every PID-based check is a broader change that belongs in a separate issue.

[Copilot]

🟡 Changes recommended

Attached option values cause valid system-proxy reset commands to bypass the standalone recovery path, allowing broken configuration to block the reset.

1 open issue

• Recognize attached option values when detecting proxy reset commands · New

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

A help flag in a response file is ignored, causing system-proxy reset --force --help to reset the system proxy instead of displaying help.

1 open issue

• Honor parsed help before resetting the system proxy · New

1 resolved since last review

• Recognize attached option values when detecting proxy reset commands

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human review is needed to assess interacting recovery, ownership, and command-routing risks that could lose recovery records or unexpectedly alter system proxy settings.

No open issues 🎉

1 resolved since last review

• Honor parsed help before resetting the system proxy

_{Review effort: Balanced}