Harden Windows Server compatibility and system-wide proxy.

Fix exit-IP checks for HTTP-only proxies, apply proxy via WinINet Connections blob and WinHTTP, improve VPN detection on legacy Server, add SOCKS5 host:port:user:pass exit parsing, and add win_compat probe for PowerShell 2.0 hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/sysproxy.py

@@ -1,16 +1,41 @@
-"""Set / clear the Windows system-wide HTTP proxy via the registry + WinINet broadcast."""
+"""Set / clear the Windows system-wide HTTP proxy.
+
+Three layers get configured so the proxy actually applies system-wide:
+
+1. ``HKCU\\…\\Internet Settings``       — simple values WinINet reads first
+2. ``Internet Settings\\Connections\\DefaultConnectionSettings`` binary blob —
+   overrides #1 for any process that opens the per-connection structure. On
+   enterprise images and Windows Server boxes this stale blob is the usual
+   reason "chain says connected but the browser still leaks direct".
+3. ``netsh winhttp set proxy``         — covers .NET, Windows Update, many
+   services and headless browser components that bypass WinINet.
+
+Conflicting overrides (``AutoConfigURL`` / ``AutoDetect`` WPAD) are wiped on
+engage and restored to "off" on disengage.
+"""
 from __future__ import annotations
 
 import ctypes
 import logging
+import struct
+import subprocess
 import winreg
 
 log = logging.getLogger(__name__)
 
 _KEY_PATH = r"Software\Microsoft\Windows\CurrentVersion\Internet Settings"
+_CONN_KEY_PATH = (
+    r"Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"
+)
 _SETTINGS_CHANGED = 39
 _REFRESH = 37
 
+# Flags inside the DefaultConnectionSettings binary blob
+_FLAG_DIRECT       = 0x01
+_FLAG_MANUAL_PROXY = 0x02
+_FLAG_AUTO_CONFIG  = 0x04
+_FLAG_AUTO_DETECT  = 0x08
+
 
 def _broadcast() -> None:
     """Tell running apps (browsers, etc.) that proxy settings changed."""
@@ -22,7 +47,136 @@ def _broadcast() -> None:
         pass
 
 
-def set_system_proxy(host: str, port: int, bypass: str = "localhost;127.*;10.*;192.168.*;<local>") -> None:
+def _bump_counter(prev: bytes | None) -> int:
+    """Each blob write must bump byte offset 4 for WinINet to re-read it."""
+    if not prev or len(prev) < 8:
+        return 1
+    try:
+        return int.from_bytes(prev[4:8], "little") + 1
+    except Exception:
+        return 1
+
+
+def _build_blob(
+    proxy: str,
+    bypass: str,
+    auto_config_url: str = "",
+    counter: int = 1,
+) -> bytes:
+    """Build the ``DefaultConnectionSettings`` REG_BINARY value.
+
+    Layout (little-endian):
+        u32 version (0x46)
+        u32 counter
+        u32 flags
+        u32 proxy_len; bytes proxy
+        u32 bypass_len; bytes bypass
+        u32 auto_config_len; bytes auto_config
+        bytes[32] padding (zeros) — WinINet expects trailing slack
+    """
+    flags = _FLAG_DIRECT
+    if proxy:
+        flags |= _FLAG_MANUAL_PROXY
+    if auto_config_url:
+        flags |= _FLAG_AUTO_CONFIG
+
+    p = proxy.encode("utf-8")
+    b = bypass.encode("utf-8")
+    a = auto_config_url.encode("utf-8")
+
+    return (
+        struct.pack("<III", 0x46, counter, flags)
+        + struct.pack("<I", len(p)) + p
+        + struct.pack("<I", len(b)) + b
+        + struct.pack("<I", len(a)) + a
+        + b"\x00" * 32
+    )
+
+
+def _read_blob_counter() -> int:
+    try:
+        with winreg.OpenKey(
+            winreg.HKEY_CURRENT_USER, _CONN_KEY_PATH, 0, winreg.KEY_QUERY_VALUE
+        ) as key:
+            val, _ = winreg.QueryValueEx(key, "DefaultConnectionSettings")
+            return _bump_counter(val)
+    except OSError:
+        return 1
+
+
+def _write_conn_blob(proxy: str, bypass: str) -> None:
+    """Write per-connection binary so apps using the Connections key respect us."""
+    counter = _read_blob_counter()
+    blob = _build_blob(proxy, bypass, "", counter)
+    try:
+        # The "Connections" key may not exist on freshly imaged Server installs.
+        key = winreg.CreateKeyEx(
+            winreg.HKEY_CURRENT_USER, _CONN_KEY_PATH, 0, winreg.KEY_SET_VALUE
+        )
+        with key:
+            winreg.SetValueEx(key, "DefaultConnectionSettings", 0, winreg.REG_BINARY, blob)
+            # SavedLegacySettings mirrors the same blob on some builds; keep them in sync.
+            winreg.SetValueEx(key, "SavedLegacySettings", 0, winreg.REG_BINARY, blob)
+    except OSError as e:
+        log.debug("Connections blob write failed: %s", e)
+
+
+def _clear_conn_blob() -> None:
+    counter = _read_blob_counter()
+    blob = _build_blob("", "", "", counter)
+    try:
+        with winreg.OpenKey(
+            winreg.HKEY_CURRENT_USER, _CONN_KEY_PATH, 0, winreg.KEY_SET_VALUE
+        ) as key:
+            winreg.SetValueEx(key, "DefaultConnectionSettings", 0, winreg.REG_BINARY, blob)
+            winreg.SetValueEx(key, "SavedLegacySettings", 0, winreg.REG_BINARY, blob)
+    except OSError:
+        pass
+
+
+def _wipe_autoconfig(key: winreg.HKEYType) -> None:
+    """Remove WPAD / PAC overrides that would silently bypass our manual proxy."""
+    for name in ("AutoConfigURL", "AutoDetect"):
+        try:
+            winreg.DeleteValue(key, name)
+        except OSError:
+            pass
+
+
+def _set_winhttp_proxy(host: str, port: int, bypass: str) -> None:
+    """netsh winhttp covers .NET / services / Windows Update / some browsers."""
+    try:
+        bypass_list = (
+            bypass.replace(";", " ")
+                  .replace("<local>", "<local>")
+                  .strip()
+        ) or "<local>"
+        subprocess.run(
+            ["netsh", "winhttp", "set", "proxy",
+             f"{host}:{port}", f"bypass-list={bypass_list}"],
+            capture_output=True, text=True, timeout=15,
+            creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+        )
+    except Exception as e:
+        log.debug("netsh winhttp set proxy failed: %s", e)
+
+
+def _reset_winhttp_proxy() -> None:
+    try:
+        subprocess.run(
+            ["netsh", "winhttp", "reset", "proxy"],
+            capture_output=True, text=True, timeout=15,
+            creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0),
+        )
+    except Exception:
+        pass
+
+
+def set_system_proxy(
+    host: str,
+    port: int,
+    bypass: str = "localhost;127.*;10.*;192.168.*;<local>",
+) -> None:
     proxy = f"{host}:{port}"
     try:
         with winreg.OpenKey(
@@ -31,10 +185,15 @@ def set_system_proxy(host: str, port: int, bypass: str = "localhost;127.*;10.*;1
             winreg.SetValueEx(key, "ProxyEnable", 0, winreg.REG_DWORD, 1)
             winreg.SetValueEx(key, "ProxyServer", 0, winreg.REG_SZ, proxy)
             winreg.SetValueEx(key, "ProxyOverride", 0, winreg.REG_SZ, bypass)
-        _broadcast()
-        log.info("System proxy set to %s (bypass: %s)", proxy, bypass)
+            _wipe_autoconfig(key)
     except OSError:
-        log.exception("Failed to set system proxy")
+        log.exception("Failed to set system proxy (HKCU root)")
+        return
+
+    _write_conn_blob(proxy, bypass)
+    _set_winhttp_proxy(host, port, bypass)
+    _broadcast()
+    log.info("System proxy set %s (bypass=%s) — root + Connections + WinHTTP", proxy, bypass)
 
 
 def clear_system_proxy() -> None:
@@ -43,11 +202,15 @@ def clear_system_proxy() -> None:
             winreg.HKEY_CURRENT_USER, _KEY_PATH, 0, winreg.KEY_SET_VALUE
         ) as key:
             winreg.SetValueEx(key, "ProxyEnable", 0, winreg.REG_DWORD, 0)
-        _broadcast()
-        log.info("System proxy cleared")
+            _wipe_autoconfig(key)
     except OSError:
         log.exception("Failed to clear system proxy")
 
+    _clear_conn_blob()
+    _reset_winhttp_proxy()
+    _broadcast()
+    log.info("System proxy cleared — root + Connections + WinHTTP")
+
 
 def is_system_proxy_set() -> bool:
     try: