@asterxsk/kiln 0.1.0 → 0.3.0

package/agent/extensions/pi-web-access/test/proxy-transport.test.mjs

@@ -1,286 +1,286 @@
-import assert from "node:assert/strict";
-import { mkdtemp, readFile, rm, writeFile, chmod } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { delimiter, join } from "node:path";
-import { test } from "node:test";
-
-import initializeExtension from "../index.ts";
-import { getActiveProxy, installGlobalProxyFetch, runWithProxy } from "../utils.ts";
-
-const originalFetch = globalThis.fetch;
-const originalPath = process.env.PATH;
-const originalAgentDir = process.env.PI_CODING_AGENT_DIR;
-const originalNoProxy = process.env.NO_PROXY;
-const originalNoProxyLower = process.env.no_proxy;
-
-// Fake shebang executables cannot run on Windows: extensionless scripts are not
-// resolvable/spawnable via CreateProcess, and `.cmd` shims are refused by
-// child_process without `shell: true` (post CVE-2024-27980 hardening). Tests
-// below that depend on the fake curl's canned responses skip there; they still
-// run on POSIX CI. Behavior-only proxy tests are unaffected and keep running.
-const SKIP_FAKE_CURL = process.platform === "win32"
-	? "requires a runnable fake curl executable (unavailable on Windows)"
-	: false;
-
-async function withFakeCurl(t, routes, fn) {
-	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-test-"));
-	const logPath = join(dir, "curl-args.jsonl");
-	const curlPath = join(dir, "curl");
-	await writeFile(curlPath, `#!/usr/bin/env node
-const fs = require("node:fs");
-const routes = JSON.parse(process.env.PI_PROXY_TEST_ROUTES);
-const args = process.argv.slice(2);
-fs.appendFileSync(process.env.PI_PROXY_TEST_LOG, JSON.stringify(args) + "\\n");
-function valueAfter(flag) {
-  const index = args.indexOf(flag);
-  return index === -1 ? null : args[index + 1];
-}
-const url = args[args.length - 1];
-const route = routes[url];
-if (!route) throw new Error("unexpected url " + url);
-fs.writeFileSync(valueAfter("-D"), "HTTP/1.1 " + route.status + " " + route.statusText + "\\r\\n" + (route.location ? "Location: " + route.location + "\\r\\n" : "") + "\\r\\n");
-fs.writeFileSync(valueAfter("--output"), route.body || "");
-process.stdout.write(JSON.stringify({ url_effective: url, num_redirects: 0 }));
-`);
-	await chmod(curlPath, 0o755);
-	if (process.platform === "win32") {
-		// Windows CreateProcess resolves executables via PATHEXT, so the
-		// extensionless shebang script above is invisible to spawn("curl").
-		// A curl.cmd shim in the same directory makes the fake win resolution.
-		await writeFile(join(dir, "curl.cmd"), `@echo off\r\nnode "%~dp0curl" %*\r\n`);
-	}
-	process.env.PATH = `${dir}${delimiter}${originalPath ?? ""}`;
-	process.env.PI_PROXY_TEST_LOG = logPath;
-	process.env.PI_PROXY_TEST_ROUTES = JSON.stringify(routes);
-	process.env.NO_PROXY = "";
-	process.env.no_proxy = "";
-	globalThis.fetch = originalFetch;
-	installGlobalProxyFetch();
-	t.after(async () => {
-		globalThis.fetch = originalFetch;
-		if (originalPath === undefined) delete process.env.PATH;
-		else process.env.PATH = originalPath;
-		if (originalNoProxy === undefined) delete process.env.NO_PROXY;
-		else process.env.NO_PROXY = originalNoProxy;
-		if (originalNoProxyLower === undefined) delete process.env.no_proxy;
-		else process.env.no_proxy = originalNoProxyLower;
-		delete process.env.PI_PROXY_TEST_LOG;
-		delete process.env.PI_PROXY_TEST_ROUTES;
-		await rm(dir, { recursive: true, force: true });
-	});
-	const result = await fn(logPath);
-	return result;
-}
-
-async function readCurlCalls(logPath) {
-	return (await readFile(logPath, "utf8"))
-		.trim()
-		.split("\n")
-		.filter(Boolean)
-		.map((line) => JSON.parse(line));
-}
-
-function headerValues(args) {
-	const values = [];
-	for (let index = 0; index < args.length; index++) {
-		if (args[index] === "-H") values.push(args[index + 1]);
-	}
-	return values;
-}
-
-function registerSourceCheck() {
-	const tools = [];
-	initializeExtension({
-		registerTool(tool) { tools.push(tool); },
-		registerCommand() {},
-		registerShortcut() {},
-		on() {},
-		appendEntry() {},
-	});
-	return tools.find((tool) => tool.name === "source_check");
-}
-
-function registerFetchContent() {
-	const tools = [];
-	initializeExtension({
-		registerTool(tool) { tools.push(tool); },
-		registerCommand() {},
-		registerShortcut() {},
-		on() {},
-		appendEntry() {},
-	});
-	return tools.find((tool) => tool.name === "fetch_content");
-}
-
-function proxyArg(args) {
-	const index = args.indexOf("-x");
-	return index === -1 ? undefined : args[index + 1];
-}
-
-test("proxy curl redirects strip caller headers across origins", { skip: SKIP_FAKE_CURL }, async (t) => {
-	await withFakeCurl(t, {
-		"https://origin.example/start": { status: 302, statusText: "Found", location: "https://other.example/final" },
-		"https://other.example/final": { status: 200, statusText: "OK", body: "ok" },
-	}, async (logPath) => {
-		const response = await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", {
-			headers: {
-				Authorization: "Bearer secret",
-				Cookie: "session=secret",
-				"X-Api-Key": "secret",
-				Accept: "text/html",
-			},
-		}));
-
-		assert.equal(await response.text(), "ok");
-		assert.equal(response.url, "https://other.example/final");
-		assert.equal(response.redirected, true);
-		const calls = await readCurlCalls(logPath);
-		assert.equal(calls.length, 2);
-		assert.ok(headerValues(calls[0]).some((header) => /^authorization:/i.test(header)));
-		assert.deepEqual(headerValues(calls[1]), []);
-		assert.ok(calls.every((args) => !args.includes("--location")));
-	});
-});
-
-test("omitted proxy uses global config while empty string forces direct access", async (t) => {
-	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-config-test-"));
-	await writeFile(join(dir, "web-search.json"), JSON.stringify({ proxy: "http://global-proxy.example:8080" }));
-	process.env.PI_CODING_AGENT_DIR = dir;
-	t.after(async () => {
-		if (originalAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
-		else process.env.PI_CODING_AGENT_DIR = originalAgentDir;
-		await rm(dir, { recursive: true, force: true });
-	});
-
-	assert.equal(runWithProxy(undefined, () => getActiveProxy()), "http://global-proxy.example:8080/");
-	assert.equal(runWithProxy("", () => getActiveProxy()), null);
-	assert.equal(runWithProxy("http://call-proxy.example:8080", () => getActiveProxy()), "http://call-proxy.example:8080/");
-});
-
-test("invalid configured proxy fails closed instead of direct fetching", async (t) => {
-	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-invalid-config-test-"));
-	await writeFile(join(dir, "web-search.json"), JSON.stringify({ proxy: "socks5://proxy.example:1080" }));
-	process.env.PI_CODING_AGENT_DIR = dir;
-	t.after(async () => {
-		if (originalAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
-		else process.env.PI_CODING_AGENT_DIR = originalAgentDir;
-		await rm(dir, { recursive: true, force: true });
-	});
-
-	assert.throws(() => getActiveProxy(), /proxy.*must use the http:\/\/ or https:\/\/ scheme/);
-});
-
-test("proxy transport does not spawn curl for pre-aborted requests", async (t) => {
-	await withFakeCurl(t, {
-		"https://origin.example/abort": { status: 200, statusText: "OK", body: "late" },
-	}, async (logPath) => {
-		const controller = new AbortController();
-		controller.abort();
-
-		await assert.rejects(
-			runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/abort", { signal: controller.signal })),
-			/error.*abort/i,
-		);
-		await assert.rejects(readFile(logPath, "utf8"), /ENOENT/);
-	});
-});
-
-test("proxy transport errors redact proxy credentials", async (t) => {
-	await withFakeCurl(t, {}, async () => {
-		await assert.rejects(
-			runWithProxy("http://user:secret@proxy.example:8080", () => fetch("https://origin.example/missing")),
-			(error) => {
-				assert.match(error.message, /http:\/\/redacted:redacted@proxy\.example:8080\//);
-				assert.doesNotMatch(error.message, /user:secret/);
-				return true;
-			},
-		);
-	});
-});
-
-test("proxy curl redirects keep caller headers on the same origin", { skip: SKIP_FAKE_CURL }, async (t) => {
-	await withFakeCurl(t, {
-		"https://origin.example/start": { status: 302, statusText: "Found", location: "/final" },
-		"https://origin.example/final": { status: 200, statusText: "OK", body: "ok" },
-	}, async (logPath) => {
-		await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", {
-			headers: { Authorization: "Bearer secret" },
-		}));
-
-		const calls = await readCurlCalls(logPath);
-		assert.equal(calls.length, 2);
-		assert.ok(headerValues(calls[1]).some((header) => /^authorization:/i.test(header)));
-	});
-});
-
-test("proxy curl keeps manual redirects as redirect responses", { skip: SKIP_FAKE_CURL }, async (t) => {
-	await withFakeCurl(t, {
-		"https://origin.example/start": { status: 302, statusText: "Found", location: "https://other.example/final" },
-	}, async (logPath) => {
-		const response = await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", { redirect: "manual" }));
-
-		assert.equal(response.status, 302);
-		assert.equal(response.headers.get("location"), "https://other.example/final");
-		assert.equal((await readCurlCalls(logPath)).length, 1);
-	});
-});
-
-test("source_check fetchContent uses the explicit proxy for result pages", { skip: SKIP_FAKE_CURL }, async (t) => {
-	const previousKey = process.env.EXA_API_KEY;
-	process.env.EXA_API_KEY = "source-check-proxy-test-key";
-	t.after(() => {
-		if (previousKey === undefined) delete process.env.EXA_API_KEY;
-		else process.env.EXA_API_KEY = previousKey;
-	});
-
-	await withFakeCurl(t, {
-		"https://api.exa.ai/answer": {
-			status: 200,
-			statusText: "OK",
-			body: JSON.stringify({
-				answer: "The API docs are available.",
-				citations: [{ title: "API docs", url: "https://example.com/api" }],
-			}),
-		},
-		"https://example.com/api": { status: 200, statusText: "OK", body: "<html><title>API docs</title><body>The API docs are available.</body></html>" },
-	}, async (logPath) => {
-		const tool = registerSourceCheck();
-		assert.ok(tool);
-		const response = await tool.execute("call", {
-			claim: "API docs",
-			fetchContent: true,
-			proxy: "http://call-proxy.example:8080",
-		}, undefined, undefined, { modelRegistry: {} });
-
-		assert.equal(response.details.sourceCount, 1);
-		const calls = await readCurlCalls(logPath);
-		const apiCall = calls.find((args) => args.at(-1) === "https://api.exa.ai/answer");
-		const pageCall = calls.find((args) => args.at(-1) === "https://example.com/api");
-		assert.ok(apiCall);
-		assert.ok(pageCall);
-		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(apiCall)));
-		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(pageCall)));
-	});
-});
-
-test("fetch_content passes the explicit proxy through queued extraction", { skip: SKIP_FAKE_CURL }, async (t) => {
-	await withFakeCurl(t, {
-		"https://example.com/page": {
-			status: 200,
-			statusText: "OK",
-			body: "<html><title>Proxy page</title><body>Fetched through the requested proxy.</body></html>",
-		},
-	}, async (logPath) => {
-		const tool = registerFetchContent();
-		assert.ok(tool);
-		const response = await tool.execute("call", {
-			url: "https://example.com/page",
-			proxy: "http://call-proxy.example:8080",
-		});
-
-		assert.equal(response.details.successful, 1);
-		const pageCall = (await readCurlCalls(logPath)).find((args) => args.at(-1) === "https://example.com/page");
-		assert.ok(pageCall);
-		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(pageCall)));
-	});
-});
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm, writeFile, chmod } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { delimiter, join } from "node:path";
+import { test } from "node:test";
+
+import initializeExtension from "../index.ts";
+import { getActiveProxy, installGlobalProxyFetch, runWithProxy } from "../utils.ts";
+
+const originalFetch = globalThis.fetch;
+const originalPath = process.env.PATH;
+const originalAgentDir = process.env.PI_CODING_AGENT_DIR;
+const originalNoProxy = process.env.NO_PROXY;
+const originalNoProxyLower = process.env.no_proxy;
+
+// Fake shebang executables cannot run on Windows: extensionless scripts are not
+// resolvable/spawnable via CreateProcess, and `.cmd` shims are refused by
+// child_process without `shell: true` (post CVE-2024-27980 hardening). Tests
+// below that depend on the fake curl's canned responses skip there; they still
+// run on POSIX CI. Behavior-only proxy tests are unaffected and keep running.
+const SKIP_FAKE_CURL = process.platform === "win32"
+	? "requires a runnable fake curl executable (unavailable on Windows)"
+	: false;
+
+async function withFakeCurl(t, routes, fn) {
+	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-test-"));
+	const logPath = join(dir, "curl-args.jsonl");
+	const curlPath = join(dir, "curl");
+	await writeFile(curlPath, `#!/usr/bin/env node
+const fs = require("node:fs");
+const routes = JSON.parse(process.env.PI_PROXY_TEST_ROUTES);
+const args = process.argv.slice(2);
+fs.appendFileSync(process.env.PI_PROXY_TEST_LOG, JSON.stringify(args) + "\\n");
+function valueAfter(flag) {
+  const index = args.indexOf(flag);
+  return index === -1 ? null : args[index + 1];
+}
+const url = args[args.length - 1];
+const route = routes[url];
+if (!route) throw new Error("unexpected url " + url);
+fs.writeFileSync(valueAfter("-D"), "HTTP/1.1 " + route.status + " " + route.statusText + "\\r\\n" + (route.location ? "Location: " + route.location + "\\r\\n" : "") + "\\r\\n");
+fs.writeFileSync(valueAfter("--output"), route.body || "");
+process.stdout.write(JSON.stringify({ url_effective: url, num_redirects: 0 }));
+`);
+	await chmod(curlPath, 0o755);
+	if (process.platform === "win32") {
+		// Windows CreateProcess resolves executables via PATHEXT, so the
+		// extensionless shebang script above is invisible to spawn("curl").
+		// A curl.cmd shim in the same directory makes the fake win resolution.
+		await writeFile(join(dir, "curl.cmd"), `@echo off\r\nnode "%~dp0curl" %*\r\n`);
+	}
+	process.env.PATH = `${dir}${delimiter}${originalPath ?? ""}`;
+	process.env.PI_PROXY_TEST_LOG = logPath;
+	process.env.PI_PROXY_TEST_ROUTES = JSON.stringify(routes);
+	process.env.NO_PROXY = "";
+	process.env.no_proxy = "";
+	globalThis.fetch = originalFetch;
+	installGlobalProxyFetch();
+	t.after(async () => {
+		globalThis.fetch = originalFetch;
+		if (originalPath === undefined) delete process.env.PATH;
+		else process.env.PATH = originalPath;
+		if (originalNoProxy === undefined) delete process.env.NO_PROXY;
+		else process.env.NO_PROXY = originalNoProxy;
+		if (originalNoProxyLower === undefined) delete process.env.no_proxy;
+		else process.env.no_proxy = originalNoProxyLower;
+		delete process.env.PI_PROXY_TEST_LOG;
+		delete process.env.PI_PROXY_TEST_ROUTES;
+		await rm(dir, { recursive: true, force: true });
+	});
+	const result = await fn(logPath);
+	return result;
+}
+
+async function readCurlCalls(logPath) {
+	return (await readFile(logPath, "utf8"))
+		.trim()
+		.split("\n")
+		.filter(Boolean)
+		.map((line) => JSON.parse(line));
+}
+
+function headerValues(args) {
+	const values = [];
+	for (let index = 0; index < args.length; index++) {
+		if (args[index] === "-H") values.push(args[index + 1]);
+	}
+	return values;
+}
+
+function registerSourceCheck() {
+	const tools = [];
+	initializeExtension({
+		registerTool(tool) { tools.push(tool); },
+		registerCommand() {},
+		registerShortcut() {},
+		on() {},
+		appendEntry() {},
+	});
+	return tools.find((tool) => tool.name === "source_check");
+}
+
+function registerFetchContent() {
+	const tools = [];
+	initializeExtension({
+		registerTool(tool) { tools.push(tool); },
+		registerCommand() {},
+		registerShortcut() {},
+		on() {},
+		appendEntry() {},
+	});
+	return tools.find((tool) => tool.name === "fetch_content");
+}
+
+function proxyArg(args) {
+	const index = args.indexOf("-x");
+	return index === -1 ? undefined : args[index + 1];
+}
+
+test("proxy curl redirects strip caller headers across origins", { skip: SKIP_FAKE_CURL }, async (t) => {
+	await withFakeCurl(t, {
+		"https://origin.example/start": { status: 302, statusText: "Found", location: "https://other.example/final" },
+		"https://other.example/final": { status: 200, statusText: "OK", body: "ok" },
+	}, async (logPath) => {
+		const response = await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", {
+			headers: {
+				Authorization: "Bearer secret",
+				Cookie: "session=secret",
+				"X-Api-Key": "secret",
+				Accept: "text/html",
+			},
+		}));
+
+		assert.equal(await response.text(), "ok");
+		assert.equal(response.url, "https://other.example/final");
+		assert.equal(response.redirected, true);
+		const calls = await readCurlCalls(logPath);
+		assert.equal(calls.length, 2);
+		assert.ok(headerValues(calls[0]).some((header) => /^authorization:/i.test(header)));
+		assert.deepEqual(headerValues(calls[1]), []);
+		assert.ok(calls.every((args) => !args.includes("--location")));
+	});
+});
+
+test("omitted proxy uses global config while empty string forces direct access", async (t) => {
+	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-config-test-"));
+	await writeFile(join(dir, "web-search.json"), JSON.stringify({ proxy: "http://global-proxy.example:8080" }));
+	process.env.PI_CODING_AGENT_DIR = dir;
+	t.after(async () => {
+		if (originalAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+		else process.env.PI_CODING_AGENT_DIR = originalAgentDir;
+		await rm(dir, { recursive: true, force: true });
+	});
+
+	assert.equal(runWithProxy(undefined, () => getActiveProxy()), "http://global-proxy.example:8080/");
+	assert.equal(runWithProxy("", () => getActiveProxy()), null);
+	assert.equal(runWithProxy("http://call-proxy.example:8080", () => getActiveProxy()), "http://call-proxy.example:8080/");
+});
+
+test("invalid configured proxy fails closed instead of direct fetching", async (t) => {
+	const dir = await mkdtemp(join(tmpdir(), "pi-proxy-invalid-config-test-"));
+	await writeFile(join(dir, "web-search.json"), JSON.stringify({ proxy: "socks5://proxy.example:1080" }));
+	process.env.PI_CODING_AGENT_DIR = dir;
+	t.after(async () => {
+		if (originalAgentDir === undefined) delete process.env.PI_CODING_AGENT_DIR;
+		else process.env.PI_CODING_AGENT_DIR = originalAgentDir;
+		await rm(dir, { recursive: true, force: true });
+	});
+
+	assert.throws(() => getActiveProxy(), /proxy.*must use the http:\/\/ or https:\/\/ scheme/);
+});
+
+test("proxy transport does not spawn curl for pre-aborted requests", async (t) => {
+	await withFakeCurl(t, {
+		"https://origin.example/abort": { status: 200, statusText: "OK", body: "late" },
+	}, async (logPath) => {
+		const controller = new AbortController();
+		controller.abort();
+
+		await assert.rejects(
+			runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/abort", { signal: controller.signal })),
+			/error.*abort/i,
+		);
+		await assert.rejects(readFile(logPath, "utf8"), /ENOENT/);
+	});
+});
+
+test("proxy transport errors redact proxy credentials", async (t) => {
+	await withFakeCurl(t, {}, async () => {
+		await assert.rejects(
+			runWithProxy("http://user:secret@proxy.example:8080", () => fetch("https://origin.example/missing")),
+			(error) => {
+				assert.match(error.message, /http:\/\/redacted:redacted@proxy\.example:8080\//);
+				assert.doesNotMatch(error.message, /user:secret/);
+				return true;
+			},
+		);
+	});
+});
+
+test("proxy curl redirects keep caller headers on the same origin", { skip: SKIP_FAKE_CURL }, async (t) => {
+	await withFakeCurl(t, {
+		"https://origin.example/start": { status: 302, statusText: "Found", location: "/final" },
+		"https://origin.example/final": { status: 200, statusText: "OK", body: "ok" },
+	}, async (logPath) => {
+		await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", {
+			headers: { Authorization: "Bearer secret" },
+		}));
+
+		const calls = await readCurlCalls(logPath);
+		assert.equal(calls.length, 2);
+		assert.ok(headerValues(calls[1]).some((header) => /^authorization:/i.test(header)));
+	});
+});
+
+test("proxy curl keeps manual redirects as redirect responses", { skip: SKIP_FAKE_CURL }, async (t) => {
+	await withFakeCurl(t, {
+		"https://origin.example/start": { status: 302, statusText: "Found", location: "https://other.example/final" },
+	}, async (logPath) => {
+		const response = await runWithProxy("http://proxy.example:8080", () => fetch("https://origin.example/start", { redirect: "manual" }));
+
+		assert.equal(response.status, 302);
+		assert.equal(response.headers.get("location"), "https://other.example/final");
+		assert.equal((await readCurlCalls(logPath)).length, 1);
+	});
+});
+
+test("source_check fetchContent uses the explicit proxy for result pages", { skip: SKIP_FAKE_CURL }, async (t) => {
+	const previousKey = process.env.EXA_API_KEY;
+	process.env.EXA_API_KEY = "source-check-proxy-test-key";
+	t.after(() => {
+		if (previousKey === undefined) delete process.env.EXA_API_KEY;
+		else process.env.EXA_API_KEY = previousKey;
+	});
+
+	await withFakeCurl(t, {
+		"https://api.exa.ai/answer": {
+			status: 200,
+			statusText: "OK",
+			body: JSON.stringify({
+				answer: "The API docs are available.",
+				citations: [{ title: "API docs", url: "https://example.com/api" }],
+			}),
+		},
+		"https://example.com/api": { status: 200, statusText: "OK", body: "<html><title>API docs</title><body>The API docs are available.</body></html>" },
+	}, async (logPath) => {
+		const tool = registerSourceCheck();
+		assert.ok(tool);
+		const response = await tool.execute("call", {
+			claim: "API docs",
+			fetchContent: true,
+			proxy: "http://call-proxy.example:8080",
+		}, undefined, undefined, { modelRegistry: {} });
+
+		assert.equal(response.details.sourceCount, 1);
+		const calls = await readCurlCalls(logPath);
+		const apiCall = calls.find((args) => args.at(-1) === "https://api.exa.ai/answer");
+		const pageCall = calls.find((args) => args.at(-1) === "https://example.com/api");
+		assert.ok(apiCall);
+		assert.ok(pageCall);
+		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(apiCall)));
+		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(pageCall)));
+	});
+});
+
+test("fetch_content passes the explicit proxy through queued extraction", { skip: SKIP_FAKE_CURL }, async (t) => {
+	await withFakeCurl(t, {
+		"https://example.com/page": {
+			status: 200,
+			statusText: "OK",
+			body: "<html><title>Proxy page</title><body>Fetched through the requested proxy.</body></html>",
+		},
+	}, async (logPath) => {
+		const tool = registerFetchContent();
+		assert.ok(tool);
+		const response = await tool.execute("call", {
+			url: "https://example.com/page",
+			proxy: "http://call-proxy.example:8080",
+		});
+
+		assert.equal(response.details.successful, 1);
+		const pageCall = (await readCurlCalls(logPath)).find((args) => args.at(-1) === "https://example.com/page");
+		assert.ok(pageCall);
+		assert.ok(["http://call-proxy.example:8080", "http://call-proxy.example:8080/"].includes(proxyArg(pageCall)));
+	});
+});