Harden Windows Server compatibility and system-wide proxy.

Fix exit-IP checks for HTTP-only proxies, apply proxy via WinINet Connections blob and WinHTTP, improve VPN detection on legacy Server, add SOCKS5 host:port:user:pass exit parsing, and add win_compat probe for PowerShell 2.0 hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/config.py

@@ -78,6 +78,57 @@ def merge_proxy_credentials(raw_url: str, username: str = "", password: str = ""
     return urlunparse((scheme, netloc, "", "", "", "")).rstrip("/")
 
 
+def parse_exit_proxy_input(
+    raw: str, default_scheme: str = "socks5"
+) -> tuple[str, str, str]:
+    """Parse any sane paste format into ``(base_url, user, password)``.
+
+    Accepts (whitespace-trimmed, default scheme = SOCKS5 when none given):
+
+      ``host:port``
+      ``host:port:user:password``
+      ``host:port:user:password:session_or_extra``  (extras folded into password)
+      ``host:port user password``                   (tab/space-separated)
+      ``user:password@host:port``
+      ``scheme://host:port``
+      ``scheme://user:password@host:port``
+
+    User and password may contain ``@``, ``:`` and arbitrary "words" — those
+    are URL-encoded automatically when ``merge_proxy_credentials`` rebuilds
+    the URL, so pasting plain text is safe.
+    """
+    t = (raw or "").strip()
+    if not t:
+        return "", "", ""
+
+    if "://" in t:
+        # Already a full URL — defer to the existing splitter.
+        return split_proxy_for_edit(t)
+
+    if "@" in t:
+        return split_proxy_for_edit(f"{default_scheme}://{t}")
+
+    if "\t" in t or any(c in t for c in (" ",)):
+        # "host:port user pass"  or  "host:port\tuser\tpass"
+        parts = [p for p in t.replace("\t", " ").split() if p]
+        if len(parts) >= 3:
+            hp, user, pw = parts[0], parts[1], " ".join(parts[2:])
+            return f"{default_scheme}://{hp}".rstrip("/"), user, pw
+        if len(parts) == 2:
+            return f"{default_scheme}://{parts[0]}".rstrip("/"), "", ""
+        t = parts[0]
+
+    bits = t.split(":")
+    if len(bits) >= 4:
+        host, port, user = bits[0], bits[1], bits[2]
+        password = ":".join(bits[3:])  # passwords containing ":" survive
+        return f"{default_scheme}://{host}:{port}", user, password
+    if len(bits) == 2:
+        return f"{default_scheme}://{bits[0]}:{bits[1]}", "", ""
+    # 1 token, or 3-token oddity — best-effort; treat as host[:port] only.
+    return f"{default_scheme}://{t}".rstrip("/"), "", ""
+
+
 def redact_proxy_url(url: str) -> str:
     """Same URL shape for logs/UI, with credentials replaced by ``***``."""
     t = (url or "").strip()