feat(network): 遵循 HTTP(S)_PROXY / NO_PROXY，覆盖全部网络路径

Node 的内置 fetch 不读取 HTTP(S)_PROXY，在公司代理/VPN 后面 CLI 的每个请求
都会直接连接失败，只能收到"可能是代理导致"的提示。现在所有网络路径在
src/utils/runtime.ts 统一解析代理：

- resolveProxy：https 目标用 HTTPS_PROXY（回落 HTTP_PROXY），http 目标用
  HTTP_PROXY，大小写均可；NO_PROXY 支持 `*`、前缀点/`*.` 子域匹配、host:port
- webFetch：有代理时经 undici 的 fetch + ProxyAgent（CONNECT 隧道），否则内置
  fetch；API 请求、Hermes base 下载、HTTP Range 请求、source map 下载全部接入
- proxyAgentFor：node-fetch 上传与 registry 版本检查（http.get）使用
  https-proxy-agent 的 CONNECT 隧道（http 目标同样走隧道：绝对 URI 形式的
  http-proxy-agent 会重写已缓冲的请求头，破坏流式请求体的分帧）
- 上传的 multipart 文件段声明 knownLength，node-fetch 改发 Content-Length
  而不是 chunked，对象存储与代理都更稳
- 有代理时跳过对上传主机的直连 TCP 延迟探测（探测结果对代理路径无意义）
- 依赖：undici ^6.28（engines 与本项目一致，Node >= 18.17）、
  https-proxy-agent ^7.0.6；均按需加载，无代理时不会 require
- bin: RNU_DEBUG=1 时同时打印错误的 cause 链（fetch 失败的真实原因）
- scripts/smoke-lib: 在 Node 上用本地模拟 API + 正向代理做端到端验证
  （apps、publish 上传、NO_PROXY 绕过），CI 的 node18-smoke 也会跑
- tests: resolveProxy 单元测试；README 说明代理变量

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Tusm6iL2itjJZDiemujAeL

Author: luoqingming

README.md

@@ -165,6 +165,8 @@ export RNU_LANG=en      # CLI language (default: zh for pushy, en for cresc)
 export RNU_DEBUG=1      # print stack traces for errors
 ```
 
+`HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY` (upper or lower case) are honored by every request: the API, package and bundle uploads, source map and Hermes base downloads, and the registry version check.
+
 ## Sentry Sourcemaps
 
 When `ios/sentry.properties` or `android/sentry.properties` exists, `bundle` uploads sourcemaps for OTA packages. The default matching path is Sentry Debug IDs; the CLI no longer infers release/dist from the native package.

README.zh-CN.md

@@ -156,6 +156,8 @@ export RNU_LANG=en      # 界面语言（默认：pushy 为 zh，cresc 为 en）
 export RNU_DEBUG=1      # 出错时打印完整堆栈
 ```
 
+所有请求都遵循 `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`（大小写均可）：API 调用、原生包与热更包上传、source map 与 Hermes base 下载、registry 版本检查。
+
 ## Sentry Sourcemap
 
 当项目存在 `ios/sentry.properties` 或 `android/sentry.properties` 时，`bundle` 会为 OTA 包上传 sourcemap。默认使用 Sentry Debug ID 匹配，不再根据原生包推导 release/dist。

bun.lock

@@ -71,6 +71,7 @@
     "fs-extra": "^11.4.0",
     "global-dirs": "^4.0.0",
     "gradle-to-js": "^2.0.1",
+    "https-proxy-agent": "^7.0.6",
     "i18next": "^26.4.0",
     "node-fetch": "^2.6.1",
     "plist": "^5.0.0",
@@ -81,6 +82,7 @@
     "registry-auth-token": "^5.1.1",
     "source-map": "0.6.1",
     "tty-table": "5.0",
+    "undici": "^6.28.0",
     "yauzl": "^3.4.0",
     "yazl": "3.3.1"
   },

package.json

@@ -4,7 +4,7 @@
 // a dependency or an API that needs a newer runtime fails here rather than on
 // a user's machine; the test suite itself runs under bun and cannot tell.
 
-const { spawnSync } = require('node:child_process');
+const { spawn, spawnSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
 
@@ -66,3 +66,248 @@ function runCli(args) {
 runCli(['help']);
 runCli(['-v']);
 console.log('smoke: `help` and `-v` ran without warnings');
+
+// --- proxy scenario ---------------------------------------------------------
+// Node's built-in fetch ignores HTTP(S)_PROXY, so the CLI routes every request
+// itself (src/utils/runtime.ts): every client opens a CONNECT tunnel through
+// the proxy. A mock API and a local forward proxy show that the API call, the
+// registry check and the multipart upload all tunnel through the proxy, and
+// that NO_PROXY switches it off again.
+
+const http = require('node:http');
+const net = require('node:net');
+const os = require('node:os');
+
+function listen(server) {
+  return new Promise((resolve) =>
+    server.listen(0, '127.0.0.1', () => resolve(server.address().port)),
+  );
+}
+
+function createMockApi(requests) {
+  return http.createServer((req, res) => {
+    requests.push(`${req.method} ${req.url}`);
+    const json = (status, body) => {
+      res.writeHead(status, { 'content-type': 'application/json' });
+      res.end(JSON.stringify(body));
+    };
+    const url = req.url ?? '/';
+    if (url.startsWith('/registry/')) {
+      return json(200, { versions: {}, 'dist-tags': { latest: '0.0.0' } });
+    }
+    if (url === '/api/app/list') {
+      return json(200, {
+        data: [{ id: 100, name: 'DemoApp', platform: 'android' }],
+      });
+    }
+    if (url === '/api/upload') {
+      return json(200, {
+        url: `http://${req.headers.host}/oss/upload`,
+        formData: { key: 'hash-from-oss' },
+      });
+    }
+    if (url === '/oss/upload') {
+      req.resume();
+      req.on('end', () => {
+        res.writeHead(204);
+        res.end();
+      });
+      return;
+    }
+    if (url === '/api/app/100/version/create') {
+      req.resume();
+      req.on('end', () => json(200, { id: 1 }));
+      return;
+    }
+    json(404, { message: `unhandled ${url}` });
+  });
+}
+
+function createForwardProxy(seen) {
+  const proxy = http.createServer((req, res) => {
+    seen.push(`${req.method} ${req.url}`);
+    const target = new URL(req.url);
+    // hop-by-hop headers are not forwarded; the client below frames the body
+    // itself (a copied transfer-encoding would make the upstream reject it)
+    const {
+      connection: _connection,
+      'proxy-connection': _proxyConnection,
+      'keep-alive': _keepAlive,
+      'transfer-encoding': _transferEncoding,
+      ...headers
+    } = req.headers;
+    const upstream = http.request(
+      {
+        host: target.hostname,
+        port: target.port,
+        path: `${target.pathname}${target.search}`,
+        method: req.method,
+        headers: { ...headers, host: target.host },
+      },
+      (response) => {
+        res.writeHead(response.statusCode ?? 502, response.headers);
+        response.pipe(res);
+      },
+    );
+    upstream.on('error', (error) => {
+      res.writeHead(502);
+      res.end(String(error));
+    });
+    req.pipe(upstream);
+  });
+  proxy.on('connect', (req, socket, head) => {
+    seen.push(`CONNECT ${req.url}`);
+    const [host, port] = req.url.split(':');
+    const tunnel = net.connect(Number(port), host, () => {
+      socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+      if (head?.length) tunnel.write(head);
+      socket.pipe(tunnel);
+      tunnel.pipe(socket);
+    });
+    tunnel.on('error', () => socket.destroy());
+    socket.on('error', () => tunnel.destroy());
+  });
+  return proxy;
+}
+
+async function proxyScenario() {
+  const apiRequests = [];
+  const seenByProxy = [];
+  const api = createMockApi(apiRequests);
+  const proxy = createForwardProxy(seenByProxy);
+  const apiPort = await listen(api);
+  const proxyPort = await listen(proxy);
+  const project = fs.mkdtempSync(path.join(os.tmpdir(), 'rnu-smoke-project-'));
+  const cache = fs.mkdtempSync(path.join(os.tmpdir(), 'rnu-smoke-cache-'));
+  fs.writeFileSync(
+    path.join(project, 'update.json'),
+    JSON.stringify({ android: { appId: 100, appKey: 'key' } }),
+  );
+  fs.writeFileSync(path.join(project, 'bundle.ppk'), 'fake-ppk');
+  const baseEnv = {
+    ...process.env,
+    NO_INTERACTIVE: 'true',
+    RNU_AUTO_UPDATE: '0',
+    PUSHY_REGISTRY: `http://127.0.0.1:${apiPort}/api`,
+    npm_config_registry: `http://127.0.0.1:${apiPort}/registry/`,
+    XDG_CACHE_HOME: cache,
+    HTTP_PROXY: `http://127.0.0.1:${proxyPort}`,
+    http_proxy: `http://127.0.0.1:${proxyPort}`,
+    HTTPS_PROXY: '',
+    https_proxy: '',
+    NO_PROXY: '',
+    no_proxy: '',
+  };
+  // asynchronous: spawnSync would block this process, and with it the mock
+  // API and the proxy the CLI is talking to
+  const run = (args, env) =>
+    new Promise((resolve, reject) => {
+      const child = spawn(
+        process.execPath,
+        [path.join(lib, 'bin.js'), ...args],
+        { cwd: project, env, stdio: ['ignore', 'pipe', 'pipe'] },
+      );
+      let stdout = '';
+      let stderr = '';
+      child.stdout.setEncoding('utf8');
+      child.stderr.setEncoding('utf8');
+      child.stdout.on('data', (chunk) => {
+        stdout += chunk;
+      });
+      child.stderr.on('data', (chunk) => {
+        stderr += chunk;
+      });
+      const timer = setTimeout(() => {
+        child.kill('SIGTERM');
+        reject(new Error(`pushy ${args.join(' ')} timed out`));
+      }, 30_000);
+      child.on('error', (error) => {
+        clearTimeout(timer);
+        reject(error);
+      });
+      child.on('close', (status) => {
+        clearTimeout(timer);
+        if (status !== 0) {
+          console.error(stdout);
+          console.error(stderr);
+          reject(new Error(`pushy ${args.join(' ')} exited with ${status}`));
+          return;
+        }
+        resolve({ stdout, stderr });
+      });
+    });
+  // tunnels to the mock host: the API client (undici), the registry check
+  // (http.get) and the upload (node-fetch) each open their own
+  const tunnels = () =>
+    seenByProxy.filter((line) => line === `CONNECT 127.0.0.1:${apiPort}`)
+      .length;
+  try {
+    await run(['apps', '--no-interactive'], baseEnv);
+    if (tunnels() < 2) {
+      throw new Error(
+        `the API call or the registry check bypassed HTTP_PROXY: ${JSON.stringify(seenByProxy)}`,
+      );
+    }
+    if (!apiRequests.includes('GET /api/app/list')) {
+      throw new Error(
+        `apps did not reach the API: ${JSON.stringify(apiRequests)}`,
+      );
+    }
+    seenByProxy.length = 0;
+    apiRequests.length = 0;
+    await run(
+      [
+        'publish',
+        'bundle.ppk',
+        '--platform',
+        'android',
+        '--name',
+        'v1',
+        '--no-interactive',
+      ],
+      baseEnv,
+    );
+    if (tunnels() < 2) {
+      throw new Error(
+        `the upload bypassed HTTP_PROXY: ${JSON.stringify(seenByProxy)}`,
+      );
+    }
+    if (!apiRequests.includes('POST /oss/upload')) {
+      throw new Error(
+        `the upload did not arrive: ${JSON.stringify(apiRequests)}`,
+      );
+    }
+    if (!apiRequests.includes('POST /api/app/100/version/create')) {
+      throw new Error(
+        `publish did not reach the API: ${JSON.stringify(apiRequests)}`,
+      );
+    }
+    seenByProxy.length = 0;
+    apiRequests.length = 0;
+    await run(['apps', '--no-interactive'], {
+      ...baseEnv,
+      NO_PROXY: '127.0.0.1',
+    });
+    if (seenByProxy.length > 0) {
+      throw new Error(`NO_PROXY was ignored: ${JSON.stringify(seenByProxy)}`);
+    }
+    if (!apiRequests.includes('GET /api/app/list')) {
+      throw new Error(
+        `the API call did not arrive directly: ${JSON.stringify(apiRequests)}`,
+      );
+    }
+    console.log(
+      'smoke: API, registry check and upload honor HTTP_PROXY and NO_PROXY',
+    );
+  } finally {
+    api.close();
+    proxy.close();
+    fs.rmSync(project, { recursive: true, force: true });
+    fs.rmSync(cache, { recursive: true, force: true });
+  }
+}
+
+proxyScenario().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});