fix(network): match NO_PROXY entries like curl, including bare IPv6 and CIDR

A bare IPv6 entry such as ::1 was read as host ':' port 1 and never matched,
IP entries only matched their exact spelling, and CIDR ranges were ignored.
Entries now follow curl: domains cover their subdomains, bracketed IPv6 may
carry a port, IP entries match any spelling, and CIDR ranges match IP-literal
destinations. NO_PROXY is parsed once per distinct value. The comments and
the self-hosting networking page describe these rules, and note that Bun's
default fetch applies its own.

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/networking.mdx

@@ -301,6 +301,8 @@ A request through the SSRF guard keeps its checks when it is proxied. Before eac
 
 Set `NO_PROXY` for every destination that is not on the public internet, not just model endpoints. The app reaches the realtime server (`SOCKET_SERVER_URL`), the Presidio PII service (`PII_URL`), and itself (`INTERNAL_API_BASE_URL`) over the same default `fetch`, alongside self-hosted Ollama, LiteLLM, and vLLM — so a proxy that cannot reach your internal network breaks live updates and PII redaction, not only inference. AWS clients and OTLP export follow the same rule, so also add an internal S3-compatible store such as MinIO, AWS VPC endpoints, and an in-cluster OpenTelemetry collector.
 
+For the SSRF guard, AWS clients, and OTLP export, Sim matches `NO_PROXY` entries the way curl does: `example.com`, `.example.com`, and `*.example.com` each cover the domain and all its subdomains; `host:port` and `[::1]:port` cover one port; IPv6 entries work bare (`::1`) or bracketed; and CIDR ranges such as `10.0.0.0/8` cover IP-literal destinations only, not hostnames that resolve into the range. Bun's default `fetch`, which carries internal service URLs such as the realtime server and PII service, applies Bun's own `NO_PROXY` rules, which may not honor CIDR or bare IPv6 entries, so list those destinations by hostname.
+
 Set it in the application environment, not your shell — under `app.env` on Helm, or the service's `environment:` on Compose. On Helm the suffixes alone are not enough: the chart wires `SOCKET_SERVER_URL`, `PII_URL`, and `OLLAMA_URL` to bare Service names, which no domain suffix matches. Add those names too — `helm template` prints the rendered ones, and the prefix is the release name unless it already contains `sim`, in which case it is the release name alone:
 
   ```yaml

apps/sim/lib/core/network/environment-proxy.server.test.ts

@@ -323,6 +323,66 @@ describe('proxy selection from the environment', () => {
       target: 'https://api.example.com/',
       proxy: 'http://p:3128/',
     },
+    {
+      case: 'a bare NO_PROXY domain also excludes its subdomains',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: 'example.com' },
+      target: 'https://api.example.com/',
+      proxy: null,
+    },
+    {
+      case: 'a leading-dot NO_PROXY domain also excludes the apex',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '.example.com' },
+      target: 'https://example.com/',
+      proxy: null,
+    },
+    {
+      case: 'a NO_PROXY domain does not match a longer name that merely ends with it',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: 'example.com' },
+      target: 'https://notexample.com/',
+      proxy: 'http://p:3128/',
+    },
+    {
+      case: 'a bare IPv6 NO_PROXY entry excludes that address',
+      env: { HTTP_PROXY: 'http://p:3128', NO_PROXY: 'localhost,::1' },
+      target: 'http://[::1]:3000/',
+      proxy: null,
+    },
+    {
+      case: 'an IPv6 NO_PROXY entry matches any spelling of the address',
+      env: { HTTP_PROXY: 'http://p:3128', NO_PROXY: '0:0:0:0:0:0:0:1' },
+      target: 'http://[::1]/',
+      proxy: null,
+    },
+    {
+      case: 'a bracketed IPv6 NO_PROXY entry with a port only excludes that port',
+      env: { HTTP_PROXY: 'http://p:3128', NO_PROXY: '[::1]:3000' },
+      target: 'http://[::1]:4000/',
+      proxy: 'http://p:3128/',
+    },
+    {
+      case: 'an IPv4 CIDR NO_PROXY entry excludes addresses inside the range',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '10.0.0.0/8' },
+      target: 'https://10.20.30.40/',
+      proxy: null,
+    },
+    {
+      case: 'an IPv4 CIDR NO_PROXY entry leaves addresses outside the range proxied',
+      env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '10.0.0.0/8' },
+      target: 'https://11.0.0.1/',
+      proxy: 'http://p:3128/',
+    },
+    {
+      case: 'an IPv6 CIDR NO_PROXY entry excludes addresses inside the range',
+      env: { HTTP_PROXY: 'http://p:3128', NO_PROXY: 'fd00::/8' },
+      target: 'http://[fd12::1]/',
+      proxy: null,
+    },
+    {
+      case: 'an empty lowercase no_proxy does not hide the uppercase one',
+      env: { HTTPS_PROXY: 'http://p:3128', no_proxy: '', NO_PROXY: 'example.com' },
+      target: 'https://example.com/',
+      proxy: null,
+    },
     {
       case: 'NO_PROXY=* excludes every destination',
       env: { HTTPS_PROXY: 'http://p:3128', NO_PROXY: '*' },

apps/sim/lib/core/network/environment-proxy.server.ts

@@ -1,6 +1,12 @@
+import { BlockList, isIP } from 'node:net'
+import { unwrapIpv6Brackets } from '@sim/security/hostnames'
+
 const DEFAULT_PORTS: Record<string, number> = { 'http:': 80, 'https:': 443 }
 
-/** An empty lowercase variable counts as unset, so it cannot hide the uppercase one. */
+/**
+ * Lowercase wins when set, but an empty lowercase variable counts as unset, so it cannot hide
+ * the uppercase one (undici's `EnvHttpProxyAgent` lets an empty `no_proxy` hide `NO_PROXY`).
+ */
 function readEnv(lower: string, upper: string): string | undefined {
   return process.env[lower]?.trim() || process.env[upper]?.trim() || undefined
 }
@@ -10,27 +16,87 @@ export function isEnvironmentProxyConfigured(): boolean {
   return Boolean(readEnv('https_proxy', 'HTTPS_PROXY') ?? readEnv('http_proxy', 'HTTP_PROXY'))
 }
 
-/** Matches `NO_PROXY` the way undici's `EnvHttpProxyAgent` does, so both stacks agree. */
+type NoProxyRule =
+  | { kind: 'domain'; domain: string; port: number }
+  | { kind: 'address'; family: 'ipv4' | 'ipv6'; addresses: BlockList; port: number }
+
+function ipFamily(address: string): 'ipv4' | 'ipv6' | null {
+  const version = isIP(address)
+  return version === 4 ? 'ipv4' : version === 6 ? 'ipv6' : null
+}
+
+/**
+ * Parses one `NO_PROXY` entry, or null when it can never match. A bracketed IPv6 address may
+ * carry a port (`[::1]:8080`); a bare one (`::1`) never does, since its last group reads as one.
+ */
+function parseNoProxyEntry(entry: string): NoProxyRule | null {
+  let host = entry
+  let port = 0
+  const bracketed = entry.match(/^\[([^\]]+)\](?::(\d+))?$/)
+  const withPort = entry.match(/^(.+):(\d+)$/)
+  if (bracketed) {
+    host = bracketed[1]
+    port = bracketed[2] ? Number(bracketed[2]) : 0
+  } else if (withPort && isIP(entry.split('/')[0]) !== 6) {
+    host = withPort[1]
+    port = Number(withPort[2])
+  }
+  const [address, prefix] = host.split('/')
+  const family = ipFamily(address)
+  if (!family) return { kind: 'domain', domain: host.replace(/^\*?\./, '').toLowerCase(), port }
+  const addresses = new BlockList()
+  try {
+    if (prefix === undefined) addresses.addAddress(address, family)
+    else if (/^\d+$/.test(prefix)) addresses.addSubnet(address, Number(prefix), family)
+    else return null
+  } catch {
+    return null
+  }
+  return { kind: 'address', family, addresses, port }
+}
+
+/** The last parsed `NO_PROXY`, so each request reuses its rules until the value changes. */
+let parsedNoProxy: { raw: string; rules: NoProxyRule[] } | null = null
+
+function noProxyRules(raw: string): NoProxyRule[] {
+  if (parsedNoProxy?.raw !== raw) {
+    const rules = raw
+      .split(/[,\s]/)
+      .filter(Boolean)
+      .map(parseNoProxyEntry)
+      .filter((rule): rule is NoProxyRule => rule !== null)
+    parsedNoProxy = { raw, rules }
+  }
+  return parsedNoProxy.rules
+}
+
+/**
+ * Whether `NO_PROXY` sends this destination direct, with curl's matching: `*` matches
+ * everything; `example.com`, `.example.com` and `*.example.com` all match the domain and
+ * every subdomain; `host:port` and `[v6]:port` match only that port; IP entries match any
+ * spelling of the address; and `10.0.0.0/8` or `fd00::/8` match IP-literal destinations in
+ * the range (never a hostname, which is not resolved here).
+ */
 function isExcludedByNoProxy(hostname: string, port: number): boolean {
   const noProxy = readEnv('no_proxy', 'NO_PROXY')
   if (!noProxy) return false
   if (noProxy === '*') return true
-  for (const entry of noProxy.split(/[,\s]/)) {
-    if (!entry) continue
-    const withPort = entry.match(/^(.+):(\d+)$/)
-    const entryHost = (withPort ? withPort[1] : entry).replace(/^\*?\./, '').toLowerCase()
-    const entryPort = withPort ? Number.parseInt(withPort[2], 10) : 0
-    if (entryPort && entryPort !== port) continue
-    if (hostname === entryHost || hostname.endsWith(`.${entryHost}`)) return true
-  }
-  return false
+  const host = unwrapIpv6Brackets(hostname.toLowerCase())
+  const hostFamily = ipFamily(host)
+  return noProxyRules(noProxy).some((rule) => {
+    if (rule.port && rule.port !== port) return false
+    if (rule.kind === 'address') {
+      return hostFamily === rule.family && rule.addresses.check(host, hostFamily)
+    }
+    return host === rule.domain || host.endsWith(`.${rule.domain}`)
+  })
 }
 
 /**
  * The operator's `HTTPS_PROXY` / `HTTP_PROXY` for a destination, or null when none applies.
  * Lowercase names win, an https destination falls back to `HTTP_PROXY`, and `NO_PROXY`
- * excludes hosts with undici's `EnvHttpProxyAgent` matching, so guarded requests leave the
- * way the default `fetch` does. Read per call so a value set after startup is honored.
+ * excludes hosts as {@link isExcludedByNoProxy} describes. Read per call so a value set
+ * after startup is honored.
  */
 export function resolveEnvironmentProxy(target: URL): string | null {
   const defaultPort = DEFAULT_PORTS[target.protocol]