penguin-harness/changelog/unreleased/2026-08-06-system-proxy-switch.md

Admin "use system HTTP proxy" switch

The sidebar user menu gains an admin-only, server-global "Use system HTTP proxy" switch (default on, saved immediately, stored in a new server_settings table and served by GET/PUT /api/admin/settings), implementing the long-specced 出网与系统代理 design.

• On: the server honors HTTP_PROXY / HTTPS_PROXY / NO_PROXY (both spellings). Node's built-in fetch ignores those variables, so the server now routes all of its own outbound traffic — LLM provider requests, the update check, image downloads — through an undici global dispatcher and fetch, installed once at the entry.
• Off: the server always connects directly, and the proxy variables (including ALL_PROXY; NO_PROXY kept) are stripped from agent command subprocesses via a new optional stripProxyEnv getter threaded through the SDK's CreateAgentOptions → Environment (absent = proxy allowed, so standalone SDK/CLI behavior is unchanged).
• Either way the effective NO_PROXY always includes localhost,127.0.0.1,::1, keeping loopback traffic — readiness probes, SSE, workspace previews — off any proxy.
• Toggling rebuilds the dispatcher for new connections immediately; no restart. The CLI-hosted server (penguin web) inherits the same coverage since it imports the server entry in-process.
• Desktop: the shell resolves the OS proxy at launch (Electron resolveProxy; PAC PROXY/HTTPS results, SOCKS deliberately skipped — undici speaks HTTP(S) proxies only) and injects it into the embedded server's environment without overriding explicitly configured values.