Qiu Yuzhou
88af8bfdf2
Apps honoring only the HTTP proxy family were never proxied under the SOCKS-only projection. Point system HTTP and HTTPS at the always-on sslocal HTTP inbound (CONNECT); reject documents lacking that inbound instead of aiming at port 0. See ADR 0012.
1.2 KiB
Write HTTP and HTTPS system proxies alongside SOCKS
Status: accepted
Enabling the system proxy switch writes the macOS HTTP and HTTPS proxy entries in addition to the SOCKS entry (ADR-0007 had disabled the HTTP/HTTPS families and projected a SOCKS target only). All three families point at 2.0's own local inbounds: SOCKS at the SOCKS5 listener, and HTTP and HTTPS at the always-on local HTTP inbound — shadowsocks-rust serves HTTP CONNECT directly, so no Privoxy-style bridge returns. HTTPS and HTTP share one endpoint because both are served by the same CONNECT-capable inbound. Exceptions, PAC/auto-discovery suppression, and the ownership snapshot/restore protocol are unchanged.
The launch health gate already probes every configured inbound, so the HTTP endpoint must be reachable before any system proxy write happens. A runtime document without a usable HTTP inbound port is rejected by the mode projection (invalidHTTPPort) instead of pointing the system at an invalid port. NG2 has not shipped, so no migration of previously applied system-proxy state is required: the next convergence writes the new shape, and restore keeps returning the pre-app snapshot.