feat(provider-utils): WS proxy tunnel + RFC-0034 (realtime STT follow-ups)

aimux-provider-utils/Cargo.toml

@@ -27,14 +27,21 @@ chrono = "0.4"
 
 # WebSocket client (RFC-0028 realtime transcription). Optional: enabled via
 # the `ws` feature so consumers without realtime needs compile it out.
+# rustls/webpki-roots build the TLS ClientConfig for the proxy-tunnel path
+# (RFC-0034 §2); base64 encodes Proxy-Authorization credentials.
 tokio-tungstenite = { workspace = true, optional = true }
+rustls = { version = "0.23", default-features = false, features = [
+    "ring",
+], optional = true }
+webpki-roots = { version = "0.26", optional = true }
+base64 = { version = "0.22", optional = true }
 
 [features]
-ws = ["dep:tokio-tungstenite"]
+ws = ["dep:tokio-tungstenite", "dep:rustls", "dep:webpki-roots", "dep:base64"]
 
 [dev-dependencies]
 aimux-core = { workspace = true }
-tokio = { workspace = true, features = ["test-util", "macros", "rt", "time"] }
+tokio = { workspace = true, features = ["test-util", "macros", "rt", "time", "net", "io-util"] }
 serial_test = { workspace = true }
 wiremock = "0.6"
 

aimux-provider-utils/src/http.rs

@@ -51,11 +51,20 @@ static SHARED: OnceLock<Mutex<HashMap<Option<tokio::runtime::Id>, Client>>> = On
 const SHARED_CLIENT_CAP: usize = 8;
 
 /// Set proxy configuration before the first HTTP operation.
+///
+/// The HTTP client snapshots this config when it is first built; the
+/// WebSocket connect path (RFC-0034 §2) re-reads it live on every connect,
+/// so a late `init_proxy` can affect WS while HTTP keeps its first-built
+/// client. Set it before any traffic either way.
 pub fn init_proxy(config: ProxyConfig) -> bool {
     GLOBAL_PROXY.set(config).is_ok()
 }
 
-fn global_proxy() -> ProxyConfig {
+/// Return the process-wide proxy configuration (empty default when
+/// `init_proxy` was never called). Read by both the HTTP client builder and
+/// the WebSocket connect path (RFC-0034 §2), so `ws://`/`wss://` traffic
+/// honors the same proxy/no_proxy settings as HTTP.
+pub(crate) fn global_proxy() -> ProxyConfig {
     GLOBAL_PROXY.get().cloned().unwrap_or_default()
 }