[WRONG BRANCH] fix(config): validate noProxy values to prevent startup crash

[luvs01]

Motivation

• The runtime began consuming a newly-introduced noProxy field without runtime validation, allowing malformed persisted values (non-strings / mixed arrays) to reach applyProxyEnv and throw when it called string-only methods, preventing startup.
• The top-level schema used .passthrough() so undeclared fields could be preserved on disk but must not be allowed to create new crash paths at runtime.

Description

• Add a noProxySchema (string | string[]) and declare noProxy in the top-level Zod configSchema so the load-time representation is well-formed or degrades safely.
• Add a write-time guard noProxyError integrated into validateConfigCandidate() so CLI config set/import rejects malformed noProxy candidates instead of persisting them.
• Harden applyProxyEnv() to defensively ignore non-string array elements and non-string values (filtering non-strings and treating non-string raw values as empty) so malformed persisted values no longer throw during startup.
• Add regression tests covering candidate validation, safe loading of a malformed persisted noProxy, and runtime handling of malformed array entries in tests/config.test.ts and tests/proxy-env.test.ts.

Testing

• ✅ Focused unit tests: ran bun test tests/proxy-env.test.ts tests/config.test.ts and the affected tests passed (focused suite completed successfully).
• ✅ Typecheck: ran bun run typecheck and it succeeded.
• ⚠️ Full test run: bun run test exercised the full repository and surfaced unrelated, preexisting failures in other subsystems; the focused tests for this change passed and the typecheck is green, so the patch is limited to the config/proxy boundary and validated by the focused runs.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3749698c-8a68-4e66-b488-b6f3b7218e60

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 830aa5b651

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve valid bypasses in mixed persisted arrays

When a hand-edited noProxy array contains both a valid bypass and one malformed element (for example, ["internal.example", 1]), z.array(z.string()) fails and .catch(undefined) discards the entire field. Consequently, loadConfig() removes internal.example before applyProxyEnv() can perform its new element-level filtering, so requests intended to bypass the proxy are routed through it. Salvage string elements individually on the read path while retaining noProxyError() for strict live writes, and cover the mixed persisted-array case.

Useful? React with 👍 / 👎.

[luvs01]

Superseded: reworked as a self-contained upstream PR against current dev.