Secret substitution fails with HTTPS_PROXY that uses http:// and port 80

[manderson23]

Running microsandbox in an environment with a corporate proxy configured as

HTTPS_PROXY="http://proxy.corporate.com:80"

secret substitution for https connections fails as the TLS proxy isn't used.

For example,

curl -v -H "Authorization: Basic $BASIC_AUTH" https://internal.corporate.com/api/auth

gives output like

* Uses proxy env variable NO_PROXY == '127.0.0.1,localhost'
* Uses proxy env variable HTTPS_PROXY == 'http://proxy.corporate.com:80'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying x.x.x.x:80...
* Connected to proxy.corporate.com (x.x.x.x) port 80 (#0)
* allocate connect buffer!
* Establish HTTP proxy tunnel to internal.corporate.com:443
> CONNECT internal.corporate.com:443 HTTP/1.1
> Host: internal.corporate.com:443
> User-Agent: curl/7.76.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 200 Connection Established
<
* Proxy replied 200 to CONNECT request
* CONNECT phase completed!

<snipped SSL cert verification>

> GET /api/auth HTTP/1.1
> Host: internal.corporate.com
> User-Agent: curl/7.76.1
> Accept: */*
> Authorization: Basic $MSB_ARTIFACTORY_BASIC_AUTH
>
* TLSv1.2 (IN), TLS header, Unknown (23):
{ [5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 401 Unauthorized
< Date: Mon, 18 May 2026 08:52:34 GMT
< Content-Type: application/json;charset=ISO-8859-1
< Content-Length: 108
< Connection: keep-alive

* Connection #0 to host proxy.corporate.com left intact
{
  "errors" : [ {
    "status" : 401,
    "message" : "Failed to decode basic authentication token"
  } ]

where $MSB_ARTIFACTORY_BASIC_AUTH is passed.

Perhaps related to #646

[toksdotdev]

spent some time looking at this, and it's slightly different from #646. we don't support HTTP/SOCK proxies yet for secret substitution.

in this case, curl opens a plain TCP connection to the proxy, sends CONNECT target:443, then starts TLS inside that tunnel. microsandbox currently only runs TLS interception/secret substitution when the outer destination port is intercepted, defaulting to 443, so a proxy on port 80 goes through the plain TCP relay and the inner HTTPS request stays opaque.

fix should be to detect HTTP CONNECT in the TCP proxy, establish the tunnel, then run the existing TLS MITM + secret substitution path over the tunneled connection. i'll try to get in a fix soon.

also filed #769 to extend this support to SOCK proxies.