fix(install): answer the direct lookup in the shape Node asks for (#2840)

packages/provision-kit/src/install-source-network-transport.test.ts

@@ -1,6 +1,13 @@
 import assert from 'node:assert/strict';
-import { test } from 'vitest';
-import { matchesNoProxy, resolveProxyForUrl } from './install-source-network-transport.ts';
+import http from 'node:http';
+import type { AddressInfo } from 'node:net';
+import { text } from 'node:stream/consumers';
+import { test, vi } from 'vitest';
+import {
+  matchesNoProxy,
+  requestApprovedUrl,
+  resolveProxyForUrl,
+} from './install-source-network-transport.ts';
 
 test('lowercase proxy variables override uppercase even when empty', () => {
   assert.equal(
@@ -37,3 +44,28 @@ test('NO_PROXY matches exact hosts, subdomains, ports, wildcards, and bracketed
   );
   assert.equal(matchesNoProxy(new URL('https://elsewhere.example'), '*'), true);
 });
+
+test('direct requests connect to the approved address through the real lookup', async () => {
+  vi.stubEnv('no_proxy', '*');
+  const server = http.createServer((_request, response) => response.end('artifact'));
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+  try {
+    const { port } = server.address() as AddressInfo;
+    const response = await requestApprovedUrl({
+      url: new URL(`http://approved.invalid:${port}/app.zip`),
+      approvedAddress: '127.0.0.1',
+      family: 4,
+      headers: {},
+      signal: AbortSignal.timeout(5_000),
+    });
+    try {
+      assert.equal(response.statusCode, 200);
+      assert.equal(await text(response.body), 'artifact');
+    } finally {
+      await response.close();
+    }
+  } finally {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    vi.unstubAllEnvs();
+  }
+});

packages/provision-kit/src/install-source-network-transport.ts

@@ -73,7 +73,15 @@ export function matchesNoProxy(url: URL, raw: string | undefined): boolean {
 
 function directDispatcher(address: string, family: 4 | 6): Agent {
   return new Agent({
-    connect: { lookup: (_hostname, _options, callback) => callback(null, address, family) },
+    connect: {
+      lookup: (_hostname, options, callback) => {
+        if (options.all) {
+          callback(null, [{ address, family }]);
+          return;
+        }
+        callback(null, address, family);
+      },
+    },
   });
 }