@duckduckgo/autoconsent 16.41.0 → 16.42.0

package/.agents/skills/proxy-testing/SKILL.md

@@ -28,13 +28,10 @@ npm run prepublish # builds dist/autoconsent.playwright.js and rules/rules.json
 
 Environment variables:
 
-- `REGIONAL_PROXY_<TWO_LETTER_REGION_CODE>` (for example, `REGIONAL_PROXY_US`, `REGIONAL_PROXY_GB`, `REGIONAL_PROXY_AU`, etc.) - the domain endpoint
-- `REGIONAL_PROXY_USERNAME`
-- `REGIONAL_PROXY_PASSWORD`
+- `REGIONAL_PROXY_<TWO_LETTER_REGION_CODE>` (for example, `REGIONAL_PROXY_US`, `REGIONAL_PROXY_GB`, `REGIONAL_PROXY_AU`, etc.) - a complete proxy URL with an `http://`, `https://`, or `socks5://` scheme. Examples: `socks5://usc-socks-tr-cluster.duckduckgo.com:80`, `https://proxy.example.com:443`.
+- `REGIONAL_PROXY_USERNAME` and `REGIONAL_PROXY_PASSWORD` (optional) - shared credentials, passed to Playwright for `https://` proxies only. They are ignored for `http://` and `socks5://` proxies.
 
-- Endpoints must be bare hostnames: no scheme, credentials, or port.
-- The library adds `https://` and port `443`.
-- Credentials are shared across regions.
+Never embed credentials in a proxy URL.
 
 ## Usage
 
@@ -91,7 +88,7 @@ export default defineConfig({
 - `ALL_REGIONS` — all supported regions.
 - `testPage(page, url, regionKey, options?)` — run a full test on a page you created yourself (you own the browser/context); returns a `TestResult`.
 - `injectAutoconsent(page, options?)` — set up isolated-world injection; call before `page.goto()`. Returns a context (`received`, `hasMessage`, `waitForCompletion`, `waitForMessage`, `collectResult`).
-- `buildProxyConfig(regionKey)` — build the Playwright `{ server, username, password }` proxy object for a region from its env vars.
+- `buildProxyConfig(regionKey)` — build the Playwright proxy object for a region from its env vars; returns `{ server, username, password }` for `https://` proxies when credentials are set, otherwise `{ server }`.
 - `launchRegionalProxyBrowser(regionKey, options?)` — launch a Chromium browser routed through the region's proxy.
 - `formatResult(result)` — format a `TestResult` as a human-readable summary line.
 
@@ -128,7 +125,7 @@ await browser.close();
 
 ## Gotchas
 
-- Use Playwright's proxy auth object: `{ server, username, password }`.
+- HTTPS proxy credentials go in Playwright's proxy auth object (`{ server, username, password }`); Chromium cannot authenticate to SOCKS proxies.
 - Never embed proxy credentials in URLs, command lines, logs, traces, or source.
 - Call `injectAutoconsent(page)` before `page.goto()` so the init script is installed before page scripts run.
 - The content script runs in an isolated world (via CDP) and `eval` snippets run in the page's main world, matching the extension. Chromium only.

package/.agents/skills/proxy-testing/scripts/regional-proxy.mjs

@@ -1,15 +1,14 @@
 /**
- * Playwright HTTPS regional proxy utilities for multi-region autoconsent testing.
+ * Playwright regional proxy utilities for multi-region autoconsent testing.
  *
- * Launches a local Chromium browser with an HTTPS proxy selected by region, injects
+ * Launches a local Chromium browser with a proxy selected by region, injects
  * autoconsent into an isolated world (via CDP), and evaluates opt-out/opt-in flows.
  * Chromium only - isolated worlds are reached through CDP, which Playwright exposes for
  * Chromium alone.
  *
  * Requires env vars:
- * - REGIONAL_PROXY_<REGION> (REGION is the uppercased two-letter region code)
- * - REGIONAL_PROXY_USERNAME
- * - REGIONAL_PROXY_PASSWORD
+ * - REGIONAL_PROXY_<REGION> (REGION is the uppercased two-letter region code): a complete proxy URL
+ * - REGIONAL_PROXY_USERNAME and REGIONAL_PROXY_PASSWORD (optional, used for https:// proxies only)
  */
 
 /**
@@ -95,7 +94,7 @@ export const EXPANDED_REGIONS = ['us', 'gb', 'de', 'fr', 'nl', 'pl', 'au', 'ca',
  * Build the Playwright proxy object for a region.
  * @param {string} regionKey - Two-letter region code (e.g. 'us', 'gb').
  * @param {NodeJS.ProcessEnv} [env]
- * @returns {{ server: string, username: string, password: string }}
+ * @returns {{ server: string, username?: string, password?: string }}
  */
 export function buildProxyConfig(regionKey, env = process.env) {
     const envVar = `REGIONAL_PROXY_${regionKey.toUpperCase()}`;
@@ -103,27 +102,28 @@ export function buildProxyConfig(regionKey, env = process.env) {
     const username = env.REGIONAL_PROXY_USERNAME;
     const password = env.REGIONAL_PROXY_PASSWORD;
 
-    if (!endpoint || !username || !password) {
-        throw new Error(
-            `Missing proxy environment variables for region "${regionKey}". ` +
-                `Expected ${envVar}, REGIONAL_PROXY_USERNAME, and REGIONAL_PROXY_PASSWORD.`,
-        );
+    if (!endpoint) {
+        throw new Error(`Missing proxy environment variable for region "${regionKey}". Expected ${envVar}.`);
     }
-    if (endpoint.includes('://') || endpoint.includes('@') || /:\d+$/.test(endpoint)) {
-        throw new Error(
-            `${envVar} should be a bare hostname without scheme, credentials, or port. ` + 'The library adds https:// and port 443.',
-        );
+    if (!endpoint.includes('://')) {
+        throw new Error(`${envVar} must be a complete proxy URL (http://, https://, or socks5://).`);
     }
-
-    return {
-        server: `https://${endpoint}:443`,
-        username,
-        password,
-    };
+    const parsed = new URL(endpoint);
+    if (!['http:', 'https:', 'socks5:'].includes(parsed.protocol)) {
+        throw new Error(`${envVar} has unsupported proxy protocol "${parsed.protocol}".`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error(`${envVar} must not contain embedded proxy credentials.`);
+    }
+    // Credentials are only used for HTTPS proxies; Chromium cannot authenticate to SOCKS proxies.
+    if (parsed.protocol === 'https:' && username && password) {
+        return { server: endpoint, username, password };
+    }
+    return { server: endpoint };
 }
 
 /**
- * Launch a local Playwright browser through the HTTPS proxy for a region.
+ * Launch a local Playwright browser through the proxy for a region.
  * @param {string} regionKey
  * @param {Partial<TestOptions>} [options]
  * @returns {Promise<Browser>}

package/.agents/skills/proxy-testing/scripts/regional-proxy.test.mjs

@@ -0,0 +1,61 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+import { buildProxyConfig } from './regional-proxy.mjs';
+
+const credentials = {
+    REGIONAL_PROXY_PASSWORD: 'password',
+    REGIONAL_PROXY_USERNAME: 'username',
+};
+
+describe('regional proxy config', () => {
+    it('uses complete credential-free SOCKS URLs directly', () => {
+        assert.deepEqual(
+            buildProxyConfig('us', {
+                REGIONAL_PROXY_US: 'socks5://usc-socks-tr-cluster.duckduckgo.com:80',
+            }),
+            { server: 'socks5://usc-socks-tr-cluster.duckduckgo.com:80' },
+        );
+    });
+
+    it('passes credentials for HTTPS proxies', () => {
+        assert.deepEqual(buildProxyConfig('de', { REGIONAL_PROXY_DE: 'https://proxy.example:443', ...credentials }), {
+            password: 'password',
+            server: 'https://proxy.example:443',
+            username: 'username',
+        });
+    });
+
+    it('allows HTTPS proxies without credentials', () => {
+        assert.deepEqual(buildProxyConfig('de', { REGIONAL_PROXY_DE: 'https://proxy.example:443' }), {
+            server: 'https://proxy.example:443',
+        });
+    });
+
+    it('does not pass credentials for non-HTTPS proxies', () => {
+        assert.deepEqual(buildProxyConfig('us', { REGIONAL_PROXY_US: 'socks5://proxy.example:80', ...credentials }), {
+            server: 'socks5://proxy.example:80',
+        });
+        assert.deepEqual(buildProxyConfig('us', { REGIONAL_PROXY_US: 'http://proxy.example:3128', ...credentials }), {
+            server: 'http://proxy.example:3128',
+        });
+    });
+
+    it('rejects credentials embedded in URLs', () => {
+        assert.throws(
+            () => buildProxyConfig('us', { REGIONAL_PROXY_US: 'socks5://user:password@proxy.example:80' }),
+            /must not contain embedded proxy credentials/,
+        );
+    });
+
+    it('requires a protocol', () => {
+        assert.throws(
+            () => buildProxyConfig('gb', { REGIONAL_PROXY_GB: 'uks.socks.duckduckgo.com', ...credentials }),
+            /must be a complete proxy URL/,
+        );
+    });
+
+    it('rejects unsupported protocols', () => {
+        assert.throws(() => buildProxyConfig('gb', { REGIONAL_PROXY_GB: 'socks4://proxy.example:1080' }), /unsupported proxy protocol/);
+    });
+});

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+# v16.42.0 (Fri Sep 25 2026)
+
+#### Rules
+
+- Rule update: CPM crawl cluster #90: mediaset.it (iubenda|inert, 13 sites) [#1484](https://github.com/duckduckgo/autoconsent/pull/1484) ([@cursoragent](https://github.com/cursoragent) [@daxtheduck](https://github.com/daxtheduck))
+
+#### AI / Agent Workflow
+
+- update proxy skill to support internal access [#1577](https://github.com/duckduckgo/autoconsent/pull/1577) ([@ladamski](https://github.com/ladamski) [@muodov](https://github.com/muodov))
+
+#### Authors: 4
+
+- Cursor Agent ([@cursoragent](https://github.com/cursoragent))
+- Dax ([@daxtheduck](https://github.com/daxtheduck))
+- Lucas Adamski ([@ladamski](https://github.com/ladamski))
+- Maxim Tsoy ([@muodov](https://github.com/muodov))
+
+---
+
 # v16.41.0 (Tue Sep 22 2026)
 
 #### Rules