gowalk-cicd 1.0.134 → 1.0.135

package/CLAUDE.md

@@ -142,6 +142,9 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   and HTTPS_PROXY variables also name the credential-free loopback relay because
   Crashlytics Buildtools reads them first and rejects authenticated proxy URLs. HTTPS is tunneled
   without TLS interception; no upstream failure may fall back to the destination.
+  Java bypasses the relay only for exact `localhost`, `127.0.0.1` and `[::1]`
+  targets so owned HTTP test fixtures remain local. Never widen that host list;
+  external requests and environment-first clients retain the assigned relay.
   The wrapper disables Gradle daemons and closes its relay when the command ends.
   The relay's idle deadline covers the whole tunnel: traffic in either direction
   keeps downloads/uploads alive. An idle direction alone must never end a transfer.

package/README.md

@@ -517,6 +517,10 @@ The relay authenticates to that exit without putting credentials in JVM options;
 HTTPS remains an end-to-end TLS tunnel. An unavailable proxy fails the request,
 and the relay shuts down with its child command. Gradle daemons are disabled for
 these commands so they cannot retain an expired relay port.
+Java requests to exact `localhost`, `127.0.0.1` and `[::1]` targets stay local for
+HTTP test fixtures. All other Java hosts, including lookalike names such as
+`localhost.example.com`, retain the assigned proxy; environment-first clients
+continue to use the relay.
 
 ### Private git dependencies (Flutter)
 

package/action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.135

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.135

package/android-action/scripts/jvm_proxy_relay.py

@@ -149,7 +149,7 @@ def running(proxy: str):
 
 def environment(env: dict, port: int) -> dict:
     # Crashlytics Buildtools prefers HTTP_PROXY to JVM options and rejects URLs
-    # with userinfo. All child clients use the same owned relay; authentication
+    # with userinfo. External child requests use the same owned relay; authentication
     # is added only on its connection to the configured account exit.
     local = f"http://127.0.0.1:{port}"
     for name in ("HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"):
@@ -157,7 +157,8 @@ def environment(env: dict, port: int) -> dict:
     env.update(NO_PROXY="", no_proxy="")
     options = (f"-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort={port} "
                f"-Dhttps.proxyHost=127.0.0.1 -Dhttps.proxyPort={port} "
-               "-Dhttp.nonProxyHosts= -Dhttps.nonProxyHosts= -Djava.net.useSystemProxies=false")
+               "-Dhttp.nonProxyHosts=localhost|127.0.0.1|[::1] "
+               "-Dhttps.nonProxyHosts=localhost|127.0.0.1|[::1] -Djava.net.useSystemProxies=false")
     # Java prints these options at startup; they contain no proxy credentials.
     for name in ("JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "_JAVA_OPTIONS", "GRADLE_OPTS"):
         env[name] = (env.get(name, "") + " " + options).strip()

package/android-action/scripts/test_jvm_proxy_loopback.py

@@ -0,0 +1,91 @@
+"""Local HTTP fixtures stay local while every external Java request keeps the assigned relay."""
+from contextlib import contextmanager
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+import os
+from pathlib import Path
+import shutil
+import socket
+import subprocess
+import tempfile
+import threading
+import unittest
+
+import jvm_proxy_relay as relay
+from test_jvm_proxy_relay import upstream
+
+
+@contextmanager
+def fixture(ipv6=False):
+    seen = []
+
+    class Handler(BaseHTTPRequestHandler):
+        def do_GET(self):
+            seen.append(self.path)
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"owned local fixture")
+
+        def log_message(self, *_):
+            pass
+
+    class Server(ThreadingHTTPServer):
+        address_family = socket.AF_INET6 if ipv6 else socket.AF_INET
+
+    server = Server(("::1" if ipv6 else "127.0.0.1", 0), Handler)
+    thread = threading.Thread(target=server.serve_forever, daemon=True)
+    thread.start()
+    try:
+        yield server.server_port, seen
+    finally:
+        server.shutdown()
+        server.server_close()
+        thread.join(timeout=5)
+
+
+def java_probe(port, urls):
+    source = '''import java.net.*;
+public class Probe {
+  public static void main(String[] args) throws Exception {
+    for (var url : args) {
+      var connection = URI.create(url).toURL().openConnection();
+      connection.setConnectTimeout(3000); connection.setReadTimeout(3000);
+      System.out.println(new String(connection.getInputStream().readAllBytes()));
+    }
+  }
+}'''
+    with tempfile.TemporaryDirectory() as directory:
+        path = Path(directory) / "Probe.java"
+        path.write_text(source)
+        env = relay.environment({**os.environ, "JAVA_TOOL_OPTIONS": "-Dhttp.nonProxyHosts=*"}, port)
+        return subprocess.run(["java", str(path), *urls], env=env, capture_output=True, text=True, timeout=20)
+
+
+@unittest.skipUnless(shutil.which("java"), "Java runtime unavailable")
+class LoopbackTests(unittest.TestCase):
+    def test_ipv4_and_localhost_fixtures_bypass_only_the_owned_relay(self):
+        with fixture() as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+            result = java_probe(port, [f"http://127.0.0.1:{local}/literal", f"http://localhost:{local}/hostname",
+                                       "http://unresolvable.invalid/provider", "http://localhost.invalid/provider"])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "owned local fixture",
+                                                      "through pinned proxy", "through pinned proxy"])
+        self.assertEqual(requests, ["/literal", "/hostname"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider",
+                                                   "http://localhost.invalid/provider"])
+        self.assertTrue(all(row[2].startswith("Basic ") for row in seen))
+        self.assertNotIn("fixture-pass", result.stderr)
+
+    def test_ipv6_loopback_fixture_remains_local(self):
+        try:
+            with fixture(ipv6=True) as (local, requests), upstream() as (proxy, seen), relay.running(proxy) as port:
+                result = java_probe(port, [f"http://[::1]:{local}/ipv6", "http://unresolvable.invalid/provider"])
+        except OSError as exc:
+            self.skipTest(f"IPv6 fixture unavailable: {exc.errno}")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(result.stdout.splitlines(), ["owned local fixture", "through pinned proxy"])
+        self.assertEqual(requests, ["/ipv6"])
+        self.assertEqual([row[1] for row in seen], ["http://unresolvable.invalid/provider"])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.134
+1.0.135

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.134",
+  "version": "1.0.135",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {