fix(daemon): forward proxy env vars into managed daemon service definitions

[TheIanLi]

How this was found

While running no-mistakes from a WSL shell behind a local HTTP proxy, every agent step (review, test) failed with Failed to authenticate. API Error: 403 Request not allowed — even though claude --print worked fine in an interactive shell. Reproducing the daemon-spawned agent's minimal environment (env -i HOME=… PATH=… claude --print) reproduced the 403; adding the proxy variables back made it succeed. The managed daemon's systemd unit only exports HOME and PATH, so the proxy configuration the user relies on never reaches the daemon — or the agents it spawns. This PR forwards it.

---

What Changed

• Captured HTTPS_PROXY/HTTP_PROXY/NO_PROXY (and lowercase variants) from the install-time environment and bake them into the generated systemd unit and launchd plist for the managed daemon service, so the background daemon inherits the user's proxy configuration.
• Added a shared helper in internal/daemon/service.go that collects only set, non-empty proxy variables, leaving service definitions byte-for-byte unchanged when no proxy is configured; wired it into both the systemd and launchd renderers.
• Added unit tests covering proxy forwarding for both backends plus the unset/empty skip case, and documented the behavior in the troubleshooting and environment reference docs.

Risk Assessment

✅ Low: Small, additive, well-tested change that only augments generated service definitions with proxy env vars; empty-case formatting and the Windows path are correctly handled, with the only note being an intentional install-time capture tradeoff.

Testing

Ran the new and full daemon package tests (all green) and produced product-level evidence by rendering the actual systemd unit and launchd plist the installer writes: with a proxy configured, both definitions gain the proxy Environment/EnvironmentVariables entries (e.g. Environment="HTTPS_PROXY=http://127.0.0.1:7897" and the plist <key>HTTPS_PROXY</key> entries); with no proxy set the output is byte-for-byte identical to the base commit for both backends. This is a non-UI backend change, so the reviewer-visible artifacts are the generated service-definition files rather than screenshots. Throwaway evidence test and temporary base worktree were removed; working tree is clean.

Evidence: systemd unit + launchd plist diffs (no-proxy vs with-proxy)

### systemd diff (no-proxy -> with-proxy)
9a10,12
> Environment="HTTP_PROXY=http://127.0.0.1:7897"
> Environment="HTTPS_PROXY=http://127.0.0.1:7897"
> Environment="NO_PROXY=localhost,127.0.0.1"

### launchd diff (no-proxy -> with-proxy)
22a23,28
> <key>HTTP_PROXY</key>
> <string>http://127.0.0.1:7897</string>
> <key>HTTPS_PROXY</key>
> <string>http://127.0.0.1:7897</string>
> <key>NO_PROXY</key>
> <string>localhost,127.0.0.1</string>

### no-proxy output vs base commit 0e07573: IDENTICAL (systemd + launchd)

Evidence: Generated systemd unit with proxy forwarded

[Unit]
Description=no-mistakes background daemon

[Service]
Type=simple
ExecStart=/usr/local/bin/no-mistakes daemon run --root /home/u/.no-mistakes
WorkingDirectory=/home/u/.no-mistakes
Environment="HOME=/home/u"
Environment="PATH=/home/u/.local/bin:/home/u/go/bin:/home/u/.cargo/bin:/home/u/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin"
Environment="HTTP_PROXY=http://127.0.0.1:7897"
Environment="HTTPS_PROXY=http://127.0.0.1:7897"
Environment="NO_PROXY=localhost,127.0.0.1"
Restart=always
RestartSec=2

[Install]
WantedBy=default.target

Evidence: Generated launchd plist with proxy forwarded

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.kunchenguid.no-mistakes.daemon.deef23b9</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/no-mistakes</string>
    <string>daemon</string>
    <string>run</string>
    <string>--root</string>
    <string>/home/u/.no-mistakes</string>
  </array>
  <key>WorkingDirectory</key>
  <string>/home/u/.no-mistakes</string>
  <key>EnvironmentVariables</key>
  <dict>
    <key>HOME</key>
    <string>/home/u</string>
    <key>PATH</key>
    <string>/home/u/.local/bin:/home/u/go/bin:/home/u/.cargo/bin:/home/u/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin</string>
    <key>HTTP_PROXY</key>
    <string>http://127.0.0.1:7897</string>
    <key>HTTPS_PROXY</key>
    <string>http://127.0.0.1:7897</string>
    <key>NO_PROXY</key>
    <string>localhost,127.0.0.1</string>
  </dict>
  <key>StandardOutPath</key>
  <string>/home/u/.no-mistakes/logs/daemon.log</string>
  <key>StandardErrorPath</key>
  <string>/home/u/.no-mistakes/logs/daemon.log</string>
  <key>RunAtLoad</key>
  <true/>
  <key>KeepAlive</key>
  <true/>
</dict>
</plist>

Evidence: Baseline systemd unit (no proxy)

[Unit]
Description=no-mistakes background daemon

[Service]
Type=simple
ExecStart=/usr/local/bin/no-mistakes daemon run --root /home/u/.no-mistakes
WorkingDirectory=/home/u/.no-mistakes
Environment="HOME=/home/u"
Environment="PATH=/home/u/.local/bin:/home/u/go/bin:/home/u/.cargo/bin:/home/u/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin"
Restart=always
RestartSec=2

[Install]
WantedBy=default.target

Evidence: Baseline launchd plist (no proxy)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.kunchenguid.no-mistakes.daemon.deef23b9</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/no-mistakes</string>
    <string>daemon</string>
    <string>run</string>
    <string>--root</string>
    <string>/home/u/.no-mistakes</string>
  </array>
  <key>WorkingDirectory</key>
  <string>/home/u/.no-mistakes</string>
  <key>EnvironmentVariables</key>
  <dict>
    <key>HOME</key>
    <string>/home/u</string>
    <key>PATH</key>
    <string>/home/u/.local/bin:/home/u/go/bin:/home/u/.cargo/bin:/home/u/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin</string>
  </dict>
  <key>StandardOutPath</key>
  <string>/home/u/.no-mistakes/logs/daemon.log</string>
  <key>StandardErrorPath</key>
  <string>/home/u/.no-mistakes/logs/daemon.log</string>
  <key>RunAtLoad</key>
  <true/>
  <key>KeepAlive</key>
  <true/>
</dict>
</plist>

Pipeline

Updates from git push no-mistakes

⏭️ **intent** - skipped

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 info

• ℹ️ internal/daemon/service.go:56 - Proxy values are captured from the install-time environment and baked statically into the systemd/launchd service files (user-scoped, 0644). This is intentional and documented, but means (a) a proxy URL with embedded credentials (http://user:pass@host) is written in plaintext to the service definition, and (b) later proxy changes require reinstalling the service to take effect. Both are acceptable tradeoffs given the comments, just noting the new exposure surface.

✅ **Test** - passed

✅ No issues found.

• go test -race ./internal/daemon/ -run 'TestRenderLaunchAgentForwardsProxyEnv|TestServiceProxyEnvSkipsUnsetAndEmpty|TestRenderSystemdUnitForwardsProxyEnv' -v — all pass
• go test ./internal/daemon/ (full package, no regressions)
• Rendered real systemd unit + launchd plist with HTTPS_PROXY/HTTP_PROXY/NO_PROXY set and captured the generated definitions as evidence
• Diffed no-proxy vs with-proxy output for both backends — proxy lines appear only when set
• Confirmed the 'byte-for-byte unchanged when no proxy' claim by rendering the no-proxy output and diffing against the base commit 0e07573 for both systemd and launchd (IDENTICAL)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Thanks for this @TheIanLi - the proxy-forwarding fix is genuinely useful and it's properly raised via no-mistakes. One thing before it can merge: it's red on Windows CI, and the failure is in the new proxy-env code. Because Windows env-var names are case-insensitive, serviceProxyEnv() ends up emitting a duplicate HTTPS_PROXY/https_proxy entry, and TestRenderLaunchAgentForwardsEveryProxyEnvKey fails (the launchd forward assertion). Could you dedupe the proxy keys case-insensitively (and re-check the launchd path), then re-run it through no-mistakes? Happy to merge once it's green. 🙏

[TheIanLi]

Thanks @kunchenguid — addressed and re-run through no-mistakes.

Your ask (Windows dedup): serviceProxyEnv() now de-duplicates the proxy keys case-insensitively on Windows only (keeping the upper-case spelling), so the duplicate HTTPS_PROXY/https_proxy entry is gone. I also reworked TestRenderLaunchAgentForwardsEveryProxyEnvKey to inject the proxy env directly instead of reading os.LookupEnv, so it's deterministic on Windows CI. On case-sensitive platforms both spellings are still forwarded verbatim (the curl-only-lowercase case has its own test).

A few things slightly beyond the original ask — all surfaced by the no-mistakes review, pure correctness/security, no behaviour change:

• The 0600 service-file write wasn't atomic: re-installing over an existing 0644 file wrote the credential-bearing content first and only Chmod'd to 0600 afterwards — a brief world-readable window. It now writes to a same-dir temp file at the target mode and renames into place (writeFileAtomic). The non-proxy path is unchanged (still a plain 0644 os.WriteFile). The only existing code I touched is the drift-reinstall rollback (restoreOnFailure), which had the same os.WriteFile-doesn't-reset-mode gap now that it can be restoring a 0600 credential file — it routes through the same atomic write.
• systemd Environment= values weren't escaping % → %%, so a percent-encoded proxy credential (e.g. http://user:p%40ss@proxy) would hit systemd specifier expansion — silently corrupting on a known specifier and failing the unit load on systemd ≥249. Now escaped (systemdEnvironmentLine), with a regression test.

Deliberately left out: I did not change the env-less restart behaviour — a daemon start from a shell without the proxy vars still re-renders from the current environment, as before. That touches your existing PATH-refresh tradeoff and felt like your call, not mine.

Green locally (go test -race ./..., gofmt, vet). Ready for your CI approval whenever you have a moment. 🙏

[TheIanLi]

Quick follow-up: running the suite on real Windows surfaced that three service-file mode tests — TestWriteServiceFileTightensModeWhenProxyPresent, TestWriteServiceFileReplacesAtomicallyWhenProxyPresent, and TestStartRestoresStaleSystemdUnitAtOriginalModeWhenRefreshInstallFails — assert POSIX modes (0644/0600) that can't hold on Windows: Go reports 0666 for regular files there, and the proxy-bearing service file is only generated on macOS/Linux anyway. I added runtime.GOOS == "windows" skip guards to those three so the Windows CI job stays green; macOS/Linux coverage is unchanged. Re-validated through no-mistakes.

[TheIanLi]

Follow-up + a correction to my earlier note, @kunchenguid.

In an earlier comment I said an env-less daemon start "still re-renders from the current environment, as before." That wasn't right, and it glossed over a real regression in drift detection: before this PR the rendered service definition was a pure function of (exe, home, root), so re-rendering was always byte-identical and drift detection was a stable no-op. After the PR, renderSystemdUnit/renderLaunchAgent read the live proxy env — so a daemon start from a shell without the proxy vars exported rendered a no-proxy target, falsely detected drift, reinstalled, and stripped the baked-in proxy, re-introducing the exact 403 Request not allowed this PR set out to fix (plus a needless reinstall+restart churn).

Fixed in the latest commits: the drift render and the install write path now inherit the proxy already baked into the on-disk unit/plist when the current environment has none — mirroring the existing executable inheritance in reinstallManagedServiceIfChanged. Added systemdUnitProxyEnv/launchAgentProxyEnv parsers (next to the existing *Executable ones) that round-trip cleanly through the renderers, including undoing systemd's %→%% specifier doubling so a percent-encoded credential reproduces byte-for-byte. writeServiceFile keeps the 0600/atomic-write invariant on inherited writes.

Regression tests cover the systemd and launchd drift no-op (env-less restart no longer strips/churns), the write-path inheritance (e.g. a binary upgrade keeps the proxy + 0600), and the parser round-trips. I also corrected a couple of now-stale doc comments (renderSystemdUnit/renderLaunchAgent became test-only wrappers once drift detection moved to the *WithProxyEnv variants).

So the corrected behavior: an env-less restart now preserves the forwarded proxy instead of dropping it. I deliberately left the systemd EnvironmentFile=-vs-inline question alone — accepted cross-platform tradeoff, since launchd has no equivalent. All green through no-mistakes. 🙏

[TheIanLi]

Quick heads-up on the red ❌ in the checks panel, @kunchenguid — it's 4 cancelled checks, not failures: docs / build, docs / deploy, Guard generated files, and Require no-mistakes, all "Cancelled after 2s". They were cancelled by workflow concurrency because I pushed a few follow-up commits in quick succession (working around some flaky network on my end), so each new push cancelled the previous run's in-flight light workflows before they reached a verdict.

The substantive CI is green on the current head (fff02f63): CI / check, e2e, and test (ubuntu / macos / windows-latest) all pass. The windows-latest job in particular logs ok internal/daemon, ok internal/gate, and ok internal/pipeline/steps, so nothing here is a real Windows failure.

A re-run should go green on content: the PR only touches docs/*.md and internal/daemon/* (no generated files, so the guard is clean), and the body carries the no-mistakes signature. The head is stable now — no more pushes from me. Could you re-trigger those 4 cancelled checks when you get a moment? Fork PRs need a maintainer to run them. Sorry for the noise. 🙏

[kunchenguid]

Thanks @TheIanLi - merged! Really appreciate the contribution.